HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault
Research is free — Hunters explains how the bug works, the root-cause code pattern, how the fix addresses it, and how to test whether a target is affected, in chat. Investigate & write exploit is a paid run — the engine reads the advisory and fix commits, then builds and validates a working proof-of-concept exploit with reproduction steps.
Affected versions
1.8.0 → fixed in 1.9.91.10.0 → fixed in 1.10.61.11.0 → fixed in 1.11.3
Details
HashiCorp Vault vulnerable to incorrect metadata access in github.com/hashicorp/vault
The fix
Release delta 1.8.0 → 1.9.9 (contains the fix)
CHANGELOG.md+50 −15
@@ -1,34 +1,51 @@-## 1.8.0-rc1-### June 16th, 2021+## 1.8.0-rc2+### July 15th, 2021CHANGES:* core: License/EULA changes that ensure the presence of a valid HashiCorp license to start Vault. More information is available in the [Vault License FAQ](https://www.vaultproject.io/docs/enterprise/license/faqs)+* agent: Errors in the template engine will no longer cause agent to exit unless+explicitly defined to do so. A new configuration parameter,+`exit_on_retry_failure`, within the new top-level stanza, `template_config`, can+be set to `true` in order to cause agent to exit. Note that for agent to exit if+`template.error_on_missing_key` is set to `true`, `exit_on_retry_failure` must+be also set to `true`. Otherwise, the template engine will log an error but then+restart its internal runner. [[GH-11775](https://github.com/hashicorp/vault/pull/11775)]+* agent: Update to use IAM Service Account Credentials endpoint for signing JWTs+when using GCP Auto-Auth method [[GH-11473](https://github.com/hashicorp/vault/pull/11473)]* go: Update to Go 1.16.5 [[GH-11802](https://github.com/hashicorp/vault/pull/11802)]FEATURES:* **MySQL Database UI**: The UI now supports adding and editing MySQL connections in the database secret engine [[GH-11532 | MySQL Database UI](https://github.com/hashicorp/vault/pull/11532 | MySQL Database UI)]+* **MySQL Database UI**: The UI now supports adding and editing MySQL connections in the database secret engine [[GH-11532](https://github.com/hashicorp/vault/pull/11532)]* cli/api: Add lease lookup command [[GH-11129](https://github.com/hashicorp/vault/pull/11129)]* core: Add controlled capabilities to control group policy stanza-* core: Add a darwin/arm64 binary release supporting the Apple M1 CPU+* secret/rabbitmq: Add ability to customize dynamic usernames [[GH-11899](https://github.com/hashicorp/vault/pull/11899)]+* secrets/database/elasticsearch: Add ability to customize dynamic usernames [[GH-11957](https://github.com/hashicorp/vault/pull/11957)]+* secrets/database/influxdb: Add ability to customize dynamic usernames [[GH-11796](https://github.com/hashicorp/vault/pull/11796)]+* secrets/database/mongodbatlas: Add ability to customize dynamic usernames [[GH-11956](https://github.com/hashicorp/vault/pull/11956)]+* secrets/database/redshift: Add ability to customize dynamic usernames [[GH-12016](https://github.com/hashicorp/vault/pull/12016)]+* secrets/database/snowflake: Add ability to customize dynamic usernames [[GH-11997](https://github.com/hashicorp/vault/pull/11997)]+* secrets/gcp: Adds ability to use existing service accounts for generation of service account keys and access tokens. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]+* secrets/keymgmt (enterprise): Adds general availability for distributing and managing keys in AWS KMS. [[GH-11958](https://github.com/hashicorp/vault/pull/11958)]* ssh: add support for templated values in SSH CA DefaultExtensions [[GH-11495](https://github.com/hashicorp/vault/pull/11495)]* ui: Add database secret engine support for MSSQL [[GH-11231](https://github.com/hashicorp/vault/pull/11231)]IMPROVEMENTS:* agent: Update to use IAM Service Account Credentials endpoint for signing JWTs-when using GCP Auto-Auth method [[GH-11473](https://github.com/hashicorp/vault/pull/11473)]+* agent/template: Added static_secret_render_interval to specify how often to fetch non-leased secrets [[GH-11934](https://github.com/hashicorp/vault/pull/11934)]+* agent: Allow Agent auto auth to read symlinked JWT files [[GH-11502](https://github.com/hashicorp/vault/pull/11502)]* api: Allow a leveled logger to be provided to `api.Client` through `SetLogger`. [[GH-11696](https://github.com/hashicorp/vault/pull/11696)]* auth/aws: Underlying error included in validation failure message. [[GH-11638](https://github.com/hashicorp/vault/pull/11638)]+* core: Add `prefix_filter` to telemetry config [[GH-12025](https://github.com/hashicorp/vault/pull/12025)]* core: Add a small (<1s) exponential backoff to failed TCP listener Accept failures. [[GH-11588](https://github.com/hashicorp/vault/pull/11588)]* core: Add metrics for standby node forwarding. [[GH-11366](https://github.com/hashicorp/vault/pull/11366)]-* core: Add metrics to report if a node is a perf standby, if a node is a dr-secondary or primary, and if a node is a perf secondary or primary. Also allow-DR secondaries to serve metrics requests when using unauthenticated_metrics_access. [[GH-1844](https://github.com/hashicorp/vault/pull/1844)]* core: Send notifications to systemd on start, stop, and configuration reload. [[GH-11517](https://github.com/hashicorp/vault/pull/11517)]* core: add irrevocable lease list and count apis [[GH-11607](https://github.com/hashicorp/vault/pull/11607)]* core: allow arbitrary length stack traces upon receiving SIGUSR2 (was 32MB) [[GH-11364](https://github.com/hashicorp/vault/pull/11364)]+* db/cassandra: Added tls_server_name to specify server name for TLS validation [[GH-11820](https://github.com/hashicorp/vault/pull/11820)]+* plugins/ad: Added rotate-role endpoint for manual service account password rotations [[GH-11942](https://github.com/hashicorp/vault/pull/11942)]+* raft: Improve raft batch size selection [[GH-11907](https://github.com/hashicorp/vault/pull/11907)]+* raft: change freelist type to map and set nofreelistsync to true [[GH-11895](https://github.com/hashicorp/vault/pull/11895)]* replication (enterprise): The log shipper is now memoryas well as length bound, and length and size can beseparately configured.@@ -36,20 +53,31 @@ separately configured.* secrets/database/mongodb: Add ability to customize `SocketTimeout`, `ConnectTimeout`, and `ServerSelectionTimeout` [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]* secrets/database/mongodb: Increased throughput by allowing for multiple request threads to simultaneously update users in MongoDB [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]* storage/raft: Support autopilot for HA only raft storage. [[GH-11260](https://github.com/hashicorp/vault/pull/11260)]+* ui: Add Validation to KV secret engine [[GH-11785](https://github.com/hashicorp/vault/pull/11785)]* ui: Add push notification message when selecting okta auth. [[GH-11442](https://github.com/hashicorp/vault/pull/11442)]* ui: Add regex validation to Transform Template pattern input [[GH-11586](https://github.com/hashicorp/vault/pull/11586)]* ui: Add specific error message if unseal fails due to license [[GH-11705](https://github.com/hashicorp/vault/pull/11705)]+* ui: Add validation support for open api form fields [[GH-11963](https://github.com/hashicorp/vault/pull/11963)]+* ui: Added auth method descriptions to UI login page [[GH-11795](https://github.com/hashicorp/vault/pull/11795)]* ui: JSON fields on database can be cleared on edit [[GH-11708](https://github.com/hashicorp/vault/pull/11708)]* ui: Obscure secret values on input and displayOnly fields like certificates. [[GH-11284](https://github.com/hashicorp/vault/pull/11284)]* ui: Redesign of KV 2 Delete toolbar. [[GH-11530](https://github.com/hashicorp/vault/pull/11530)]* ui: Replace tool partials with components. [[GH-11672](https://github.com/hashicorp/vault/pull/11672)]+* ui: Show description on secret engine list [[GH-11995](https://github.com/hashicorp/vault/pull/11995)]* ui: Update ember to latest LTS and upgrade UI dependencies [[GH-11447](https://github.com/hashicorp/vault/pull/11447)]* ui: Update partials to components [[GH-11680](https://github.com/hashicorp/vault/pull/11680)]* ui: Updated ivy code mirror component for consistency [[GH-11500](https://github.com/hashicorp/vault/pull/11500)]* ui: Updated search select component styling [[GH-11360](https://github.com/hashicorp/vault/pull/11360)]+* ui: add transform secrets engine to features list [[GH-12003](https://github.com/hashicorp/vault/pull/12003)]+* ui: add validations for duplicate path kv engine [[GH-11878](https://github.com/hashicorp/vault/pull/11878)]* ui: show site-wide banners for license warnings if applicable [[GH-11759](https://github.com/hashicorp/vault/pull/11759)]* ui: update license page with relevant autoload info [[GH-11778](https://github.com/hashicorp/vault/pull/11778)]DEPRECATIONS:+* secrets/gcp: Deprecated the `/gcp/token/:roleset` and `/gcp/key/:roleset` paths for generating secrets for rolesets.+Use `/gcp/roleset/:roleset/token` and `/gcp/roleset/:roleset/key` instead. [[GH-12023](https://github.com/hashicorp/vault/pull/12023)]+BUG FIXES:* activity: Omit wrapping tokens and control groups from client counts [[GH-11826](https://github.com/hashicorp/vault/pull/11826)]@@ -58,32 +86,37 @@ information from the auto-auth config map on renewals or retries. [[GH-11576](ht* agent/template: fix command shell quoting issue [[GH-11838](https://github.com/hashicorp/vault/pull/11838)]* agent: Fixed agent templating to use configured tls servername values [[GH-11288](https://github.com/hashicorp/vault/pull/11288)]* agent: fix timestamp format in log messages from the templating engine [[GH-11838](https://github.com/hashicorp/vault/pull/11838)]+* auth/approle: fixing dereference of nil pointer [[GH-11864](https://github.com/hashicorp/vault/pull/11864)]* auth/jwt: Updates the [hashicorp/cap](https://github.com/hashicorp/cap) library to `v0.1.0` tobring in a verification key caching fix. [[GH-11784](https://github.com/hashicorp/vault/pull/11784)]+* auth/ldap: Fix a bug where the LDAP auth method does not return the request_timeout configuration parameter on config read. [[GH-11975](https://github.com/hashicorp/vault/pull/11975)]+* cli: Add support for response wrapping in `vault list` and `vault kv list` with output format other than `table`. [[GH-12031](https://github.com/hashicorp/vault/pull/12031)]+* cli: vault delete and vault kv delete should support the same output options (e.g. -format) as vault write. [[GH-11992](https://github.com/hashicorp/vault/pull/11992)]* core (enterprise): Fix orphan return value from auth methods executed on performance standby nodes.* core (enterprise): Fix plugins mounted in namespaces being unable to use password policies [[GH-11596](https://github.com/hashicorp/vault/pull/11596)]-* core (enterprise): serialize access to HSM entropy generation to avoid errors in concurrent key generation.+* core/metrics: Add generic KV mount support for vault.kv.secret.count telemetry metric [[GH-12020](https://github.com/hashicorp/vault/pull/12020)]* core: Fix cleanup of storage entries from cubbyholes within namespaces. [[GH-11408](https://github.com/hashicorp/vault/pull/11408)]* core: Fix edge cases in the configuration endpoint for barrier key autorotation. [[GH-11541](https://github.com/hashicorp/vault/pull/11541)]* core: Fix goroutine leak when updating rate limit quota [[GH-11371](https://github.com/hashicorp/vault/pull/11371)]* core: Fix race that allowed remounting on path used by another mount [[GH-11453](https://github.com/hashicorp/vault/pull/11453)]* core: Fix storage entry leak when revoking leases created with non-orphan batch tokens. [[GH-11377](https://github.com/hashicorp/vault/pull/11377)]+* core: Fixed double counting of http requests after operator stepdown [[GH-11970](https://github.com/hashicorp/vault/pull/11970)]* core: correct logic for renewal of leases nearing their expiration time. [[GH-11650](https://github.com/hashicorp/vault/pull/11650)]* identity: Use correct mount accessor when refreshing external group memberships. [[GH-11506](https://github.com/hashicorp/vault/pull/11506)]+* mongo-db: default username template now strips invalid '.' characters [[GH-11872](https://github.com/hashicorp/vault/pull/11872)]* pki: Only remove revoked entry for certificates during tidy if they are past their NotAfter value [[GH-11367](https://github.com/hashicorp/vault/pull/11367)]-* replication: Fix panic trying to update walState during identity group invalidation. [[GH-1865](https://github.com/hashicorp/vault/pull/1865)]-* replication: Fix: mounts created within a namespace that was part of an Allow-filtering rule would not appear on performance secondary if created after rule-was defined. [[GH-1807](https://github.com/hashicorp/vault/pull/1807)]* secret/pki: use case insensitive domain name comparison as per RFC1035 section 2.3.3* secret: fix the bug where transit encrypt batch doesn't work with key_version [[GH-11628](https://github.com/hashicorp/vault/pull/11628)]+* secrets/ad: Forward all creds requests to active node [[GH-76](https://github.com/hashicorp/vault-plugin-secrets-ad/pull/76)] [[GH-11836](https://github.com/hashicorp/vault/pull/11836)]* secrets/database/cassandra: Fixed issue where hostnames were not being validated when using TLS [[GH-11365](https://github.com/hashicorp/vault/pull/11365)]+* secrets/database/cassandra: Fixed issue where the PEM parsing logic of `pem_bundle` and `pem_json` didn't work for CA-only configurations [[GH-11861](https://github.com/hashicorp/vault/pull/11861)]* secrets/database/cassandra: Updated default statement for password rotation to allow for special characters. This applies to root and static credentials. [[GH-11262](https://github.com/hashicorp/vault/pull/11262)]* secrets/database: Fix marshalling to allow providing numeric arguments to external database plugins. [[GH-11451](https://github.com/hashicorp/vault/pull/11451)]* secrets/database: Fixed minor race condition when rotate-root is called [[GH-11600](https://github.com/hashicorp/vault/pull/11600)]* secrets/database: Fixes issue for V4 database interface where `SetCredentials` wasn't falling back to using `RotateRootCredentials` if `SetCredentials` is `Unimplemented` [[GH-11585](https://github.com/hashicorp/vault/pull/11585)]* storage/dynamodb: Handle throttled batch write requests by retrying, without which writes could be lost. [[GH-10181](https://github.com/hashicorp/vault/pull/10181)]* storage/raft: Support cluster address change for nodes in a cluster managed by autopilot [[GH-11247](https://github.com/hashicorp/vault/pull/11247)]+* storage/raft: Tweak creation of vault.db file [[GH-12034](https://github.com/hashicorp/vault/pull/12034)]* storage/raft: leader_tls_servername wasn't used unless leader_ca_cert_file and/or mTLS were configured. [[GH-11252](https://github.com/hashicorp/vault/pull/11252)]* tokenutil: Perform the num uses check before token type. [[GH-11647](https://github.com/hashicorp/vault/pull/11647)]* transform (enterprise): Fix an issue with malformed transform configuration@@ -97,7 +130,9 @@ storage when upgrading from 1.5 to 1.6. See Upgrade Notes for 1.6.x.* ui: Fix status menu no showing on login [[GH-11213](https://github.com/hashicorp/vault/pull/11213)]* ui: Fix text link URL on database roles list [[GH-11597](https://github.com/hashicorp/vault/pull/11597)]* ui: Fixed and updated lease renewal picker [[GH-11256](https://github.com/hashicorp/vault/pull/11256)]+* ui: fix control group access for database credential [[GH-12024](https://github.com/hashicorp/vault/pull/12024)]* ui: fix issue where select-one option was not showing in secrets database role creation [[GH-11294](https://github.com/hashicorp/vault/pull/11294)]+* ui: fix oidc login with Safari [[GH-11884](https://github.com/hashicorp/vault/pull/11884)]## 1.7.3### June 16th, 2021website/content/api-docs/secret/kv/kv-v2.mdx | 29 ++++++++++----------1 file changed, 15 insertions(+), 14 deletions(-)
sdk/go.sum+30 −7
@@ -142,6 +142,18 @@ github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ERgithub.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1 h1:6KMBnfEv0/kLAz0O76sliN5mXbCDcLfs2kP7ssP7+DQ=+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 h1:cCRo8gK7oq6A2L6LICkUZ+/a5rLiRXFMf1Qd4xSwxTc=+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=+github.com/hashicorp/go-secure-stdlib/password v0.1.1 h1:6JzmBqXprakgFEHwBgdchsjaA9x3GyjdI568bXKxa60=+github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 h1:Yc026VyMyIpq1UWRnakHRG01U8fJm+nEfEmjoAb00n8=+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=@@ -204,8 +216,9 @@ github.com/mitchellh/go-testing-interface v1.0.0 h1:fzU/JVNcaqHQEcVFAKeR41fkiLdIgithub.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=-github.com/mitchellh/mapstructure v1.3.2 h1:mRS76wmkOn3KkKAyXDu42V+6ebnXWIztFSYGN7GeoRg=github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=+github.com/mitchellh/mapstructure v1.4.1 h1:CpVNEelQCZBooIPDn+AR3NpivK/TIKU8bDxdASFVQag=+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=@@ -276,8 +289,9 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=-github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=@@ -287,8 +301,9 @@ golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfgolang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=golang.org/x/crypto v0.0.0-20190418165655-df01cb2cc480/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM=golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=@@ -309,8 +324,9 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLgolang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=-golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=@@ -338,11 +354,17 @@ golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wgolang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980 h1:OjiUf46hAmXblsZdnoSXsEUSKU8r1UEzcL5RVZ4gO9Y=golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=+golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=@@ -403,8 +425,9 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=gotest.tools/v3 v3.0.2 h1:kG1BFyqVHuQoVQiR1bWGnfz/fmHvvuiSPIV7rvl360E=
go.sum+20 −4
@@ -349,8 +349,8 @@ github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBgithub.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=github.com/frankban/quicktest v1.4.0/go.mod h1:36zfPVQyHxymz4cH7wlDmVwDrJuljRB60qkgn7rorfQ=github.com/frankban/quicktest v1.4.1/go.mod h1:36zfPVQyHxymz4cH7wlDmVwDrJuljRB60qkgn7rorfQ=-github.com/frankban/quicktest v1.10.0 h1:Gfh+GAJZOAoKZsIZeZbdn2JF10kN1XHNvjsvQK8gVkE=github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=+github.com/frankban/quicktest v1.13.0 h1:yNZif1OkDfNoDfb9zZa9aXIpejNR4F23Wely0c+Qdqk=github.com/frankban/quicktest v1.13.0/go.mod h1:qLE0fzW0VuyUAJgPU19zByoIr0HtCHN/r/VLSOOIySU=github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvDvId8XSGPu3rmpmSe+wKRcEWNgsfWU=@@ -622,6 +622,18 @@ github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQagithub.com/hashicorp/go-rootcerts v1.0.1/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1 h1:6KMBnfEv0/kLAz0O76sliN5mXbCDcLfs2kP7ssP7+DQ=+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 h1:cCRo8gK7oq6A2L6LICkUZ+/a5rLiRXFMf1Qd4xSwxTc=+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=+github.com/hashicorp/go-secure-stdlib/password v0.1.1 h1:6JzmBqXprakgFEHwBgdchsjaA9x3GyjdI568bXKxa60=+github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 h1:Yc026VyMyIpq1UWRnakHRG01U8fJm+nEfEmjoAb00n8=+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=github.com/hashicorp/go-slug v0.4.1 h1:/jAo8dNuLgSImoLXaX7Od7QB4TfYCVPam+OpAt5bZqc=github.com/hashicorp/go-slug v0.4.1/go.mod h1:I5tq5Lv0E2xcNXNkmx7BSfzi1PsJ2cNjs3cC3LwyhK8=github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=@@ -897,8 +909,9 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:Fgithub.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=github.com/mitchellh/mapstructure v1.2.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=-github.com/mitchellh/mapstructure v1.3.3 h1:SzB1nHZ2Xi+17FP0zVQBHIZqvwRN9408fJO8h+eeNA8=github.com/mitchellh/mapstructure v1.3.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=+github.com/mitchellh/mapstructure v1.4.1 h1:CpVNEelQCZBooIPDn+AR3NpivK/TIKU8bDxdASFVQag=+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=github.com/mitchellh/pointerstructure v1.0.0 h1:ATSdz4NWrmWPOF1CeCBU4sMCno2hgqdbSrRPFWQSVZI=github.com/mitchellh/pointerstructure v1.0.0/go.mod h1:k4XwG94++jLVsSiTxo7qdIfXA9pj9EAeo0QsNNJOLZ8=github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=@@ -1286,8 +1299,9 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhgolang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=golang.org/x/crypto v0.0.0-20201221181555-eec23a3978ad/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=-golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a h1:kr2P4QFmQr29mSLA43kwrOcgcReGTfbE9N577tCTuBc=golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=@@ -1455,8 +1469,10 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wgolang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20210316164454-77fc1eacc6aa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=-golang.org/x/sys v0.0.0-20210514084401-e8d321eab015 h1:hZR0X1kPW+nwyJ9xRxqZk1vx5RUObAPBdKVvXPDUH/E=golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
api/go.sum+26 −11
@@ -90,6 +90,14 @@ github.com/hashicorp/go-retryablehttp v0.6.6 h1:HJunrbHTDDbBb/ay4kxa1n+dLmttUlnPgithub.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=+github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1/go.mod h1:l8slYwnJA26yBz+ErHpp2IRCLr0vuOMGBORIz4rRiAs=github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=@@ -128,8 +136,9 @@ github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkgithub.com/mitchellh/go-testing-interface v0.0.0-20171004221916-a61a99592b77/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=-github.com/mitchellh/mapstructure v1.3.2 h1:mRS76wmkOn3KkKAyXDu42V+6ebnXWIztFSYGN7GeoRg=github.com/mitchellh/mapstructure v1.3.2/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=+github.com/mitchellh/mapstructure v1.4.1 h1:CpVNEelQCZBooIPDn+AR3NpivK/TIKU8bDxdASFVQag=+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=@@ -168,14 +177,15 @@ github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=-github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 h1:vEg9joUBmeBcK9iSJftGNf3coIG4HqZElCPehJsfAYM=-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=@@ -186,12 +196,12 @@ golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rgolang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=-golang.org/x/net v0.0.0-20200602114024-627f9648deb9 h1:pNX+40auqi2JqRfOP1akLGtYcn15TUbkhwuCO3foqqM=golang.org/x/net v0.0.0-20200602114024-627f9648deb9/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=@@ -205,17 +215,21 @@ golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hgolang.org/x/sys v0.0.0-20190129075346-302c3dd5f1cc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980 h1:OjiUf46hAmXblsZdnoSXsEUSKU8r1UEzcL5RVZ4gO9Y=-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=-golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c h1:F1jZWGFhYfh0Ci55sIpILtKKK8p3i2/krTr0H1rg74I=+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=+golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 h1:NusfzzA6yGQ+ua51ck7E3omNUX/JuqbFSaRGqU8CcLI=golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=@@ -253,7 +267,8 @@ gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=-gopkg.in/yaml.v2 v2.2.5 h1:ymVxjfMaHvXD8RqPRmzHHsB3VvucivSkIAvJFDI5O3c=gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
sdk/go.mod+10 −5
@@ -20,6 +20,12 @@ require (github.com/hashicorp/go-kms-wrapping/entropy v0.1.0github.com/hashicorp/go-multierror v1.1.0github.com/hashicorp/go-plugin v1.0.1+github.com/hashicorp/go-secure-stdlib/base62 v0.1.1+github.com/hashicorp/go-secure-stdlib/mlock v0.1.1+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1+github.com/hashicorp/go-secure-stdlib/password v0.1.1+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1github.com/hashicorp/go-sockaddr v1.0.2github.com/hashicorp/go-uuid v1.0.2github.com/hashicorp/go-version v1.2.0@@ -28,15 +34,14 @@ require (github.com/hashicorp/vault/api v1.1.1github.com/mitchellh/copystructure v1.0.0github.com/mitchellh/go-testing-interface v1.0.0-github.com/mitchellh/mapstructure v1.3.2+github.com/mitchellh/mapstructure v1.4.1github.com/pierrec/lz4 v2.5.2+incompatiblegithub.com/pkg/errors v0.9.1github.com/ryanuber/go-glob v1.0.0-github.com/stretchr/testify v1.5.1+github.com/stretchr/testify v1.7.0go.uber.org/atomic v1.6.0-golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9-golang.org/x/net v0.0.0-20200602114024-627f9648deb9-golang.org/x/sys v0.0.0-20200602225109-6fdc65e7d980+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110google.golang.org/grpc v1.29.1google.golang.org/protobuf v1.25.0)
website/content/api-docs/secret/kv/kv-v2.mdx+15 −14
@@ -84,15 +84,17 @@ $ curl \{"data": {"cas_required": false,-"max_versions": 0,-"delete_version_after": "3h25m19s"+"delete_version_after": "3h25m19s",+"max_versions": 0}}```## Read Secret VersionThis endpoint retrieves the secret at the specified location.+This endpoint retrieves the secret at the specified location. The metadata returned+here ( `created_time, destroy,` and `version`) is version specific. It should not be+confused with the response from the [metadata endpoint](/api/secret/kv/kv-v2#read-secret-metadata).| Method | Path || :----- | :------------------------------------------- |@@ -146,11 +148,10 @@ have an ACL policy granting the `update` capability.- `options` `(Map: <optional>)` – An object that holds option settings.- `cas` `(int: <optional>)` - Set the "cas" value to use a Check-And-Set-operation. If not set the write will be allowed. If set to 0 a write will-only be allowed if the key doesn’t exist. If the index is non-zero the-write will only be allowed if the key’s current version matches the-version specified in the cas parameter.+- `cas` `(int: <optional>)` - This flag is required if cas_required is set+to true on either the secret or the engine's config. In order for a write+to be successful, cas must be set to the current version of the secret.+If cas is set to 0, the write will only be allowed if the key doesn't exist.- `data` `(Map: <required>)` – The contents of the data map will be stored andreturned on read.@@ -367,7 +368,7 @@ entries.## Read Secret MetadataThis endpoint retrieves the metadata and versions for the secret at the-specified path.+specified path. Metadata is version-agnostic.| Method | Path || :----- | :----------------------- |@@ -391,8 +392,10 @@ $ curl \```json{"data": {+"cas_required": false,"created_time": "2018-03-22T02:24:06.945319214Z","current_version": 3,+"delete_version_after": "3h25m19s","max_versions": 0,"oldest_version": 0,"updated_time": "2018-03-22T02:36:43.986212308Z",@@ -417,12 +420,10 @@ $ curl \}```## Update Metadata+## Create/Update MetadataThis endpoint creates a new version of a secret at the specified location. If-the value does not yet exist, the calling token must have an ACL policy granting-the `create` capability. If the value already exists, the calling token must-have an ACL policy granting the `update` capability.+This endpoint creates or updates the metadata of a secret at the specified location.+It does not create a new version.| Method | Path || :----- | :----------------------- |(#12094)ui/scripts/start-vault.js | 5 +++--ui/tests/acceptance/secrets/backend/kv/secret-test.js | 2 +-2 files changed, 4 insertions(+), 3 deletions(-)
sdk/helper/strutil/strutil.go+19 −323
@@ -1,480 +1,94 @@+// DEPRECATED: this has been moved to go-secure-stdlib and will be removedpackage strutilimport (-"encoding/base64"-"encoding/json"-"fmt"-"sort"-"strings"-"github.com/hashicorp/errwrap"-glob "github.com/ryanuber/go-glob"+extstrutil "github.com/hashicorp/go-secure-stdlib/strutil")// StrListContainsGlob looks for a string in a list of strings and allows-// globs.func StrListContainsGlob(haystack []string, needle string) bool {-for _, item := range haystack {-if glob.Glob(item, needle) {-return true-}-}-return false+return extstrutil.StrListContainsGlob(haystack, needle)}// StrListContains looks for a string in a list of strings.func StrListContains(haystack []string, needle string) bool {-for _, item := range haystack {-if item == needle {-return true-}-}-return false+return extstrutil.StrListContains(haystack, needle)}// StrListContainsCaseInsensitive looks for a string in a list of strings.func StrListContainsCaseInsensitive(haystack []string, needle string) bool {-for _, item := range haystack {-if strings.EqualFold(item, needle) {-return true-}-}-return false+return extstrutil.StrListContainsCaseInsensitive(haystack, needle)}// StrListSubset checks if a given list is a subset-// of another setfunc StrListSubset(super, sub []string) bool {-for _, item := range sub {-if !StrListContains(super, item) {-return false-}-}-return true+return extstrutil.StrListSubset(super, sub)}// ParseDedupAndSortStrings parses a comma separated list of strings-// into a slice of strings. The return slice will be sorted and will-// not contain duplicate or empty items.func ParseDedupAndSortStrings(input string, sep string) []string {-input = strings.TrimSpace(input)-parsed := []string{}-if input == "" {-// Don't return nil-return parsed-}-return RemoveDuplicates(strings.Split(input, sep), false)+return extstrutil.ParseDedupAndSortStrings(input, sep)}// ParseDedupLowercaseAndSortStrings parses a comma separated list of-// strings into a slice of strings. The return slice will be sorted and-// will not contain duplicate or empty items. The values will be converted-// to lower case.func ParseDedupLowercaseAndSortStrings(input string, sep string) []string {-input = strings.TrimSpace(input)-parsed := []string{}-if input == "" {-// Don't return nil-return parsed-}-return RemoveDuplicates(strings.Split(input, sep), true)+return extstrutil.ParseDedupLowercaseAndSortStrings(input, sep)}// ParseKeyValues parses a comma separated list of `<key>=<value>` tuples-// into a map[string]string.func ParseKeyValues(input string, out map[string]string, sep string) error {-if out == nil {-return fmt.Errorf("'out is nil")-}-keyValues := ParseDedupLowercaseAndSortStrings(input, sep)-if len(keyValues) == 0 {-return nil-}-for _, keyValue := range keyValues {-shards := strings.Split(keyValue, "=")-if len(shards) != 2 {-return fmt.Errorf("invalid <key,value> format")-}-key := strings.TrimSpace(shards[0])-value := strings.TrimSpace(shards[1])-if key == "" || value == "" {-return fmt.Errorf("invalid <key,value> pair: key: %q value: %q", key, value)-}-out[key] = value-}-return nil+return extstrutil.ParseKeyValues(input, out, sep)}// ParseArbitraryKeyValues parses arbitrary <key,value> tuples. The input-// can be one of the following:-// * JSON string-// * Base64 encoded JSON string-// * Comma separated list of `<key>=<value>` pairs-// * Base64 encoded string containing comma separated list of-// `<key>=<value>` pairs-//-// Input will be parsed into the output parameter, which should-// be a non-nil map[string]string.func ParseArbitraryKeyValues(input string, out map[string]string, sep string) error {-input = strings.TrimSpace(input)-if input == "" {-return nil-}-if out == nil {-return fmt.Errorf("'out' is nil")-}-// Try to base64 decode the input. If successful, consider the decoded-// value as input.-inputBytes, err := base64.StdEncoding.DecodeString(input)-if err == nil {-input = string(inputBytes)-}-// Try to JSON unmarshal the input. If successful, consider that the-// metadata was supplied as JSON input.-err = json.Unmarshal([]byte(input), &out)-if err != nil {-// If JSON unmarshalling fails, consider that the input was-// supplied as a comma separated string of 'key=value' pairs.-if err = ParseKeyValues(input, out, sep); err != nil {-return errwrap.Wrapf("failed to parse the input: {{err}}", err)-}-}-// Validate the parsed input-for key, value := range out {-if key != "" && value == "" {-return fmt.Errorf("invalid value for key %q", key)-}-}-return nil+return extstrutil.ParseArbitraryKeyValues(input, out, sep)}// ParseStringSlice parses a `sep`-separated list of strings into a-// []string with surrounding whitespace removed.-//-// The output will always be a valid slice but may be of length zero.func ParseStringSlice(input string, sep string) []string {-input = strings.TrimSpace(input)-if input == "" {-return []string{}-}-splitStr := strings.Split(input, sep)-ret := make([]string, len(splitStr))-for i, val := range splitStr {-ret[i] = strings.TrimSpace(val)-}-return ret+return extstrutil.ParseStringSlice(input, sep)}// ParseArbitraryStringSlice parses arbitrary string slice. The input-// can be one of the following:-// * JSON string-// * Base64 encoded JSON string-// * `sep` separated list of values-// * Base64-encoded string containing a `sep` separated list of values-//-// Note that the separator is ignored if the input is found to already be in a-// structured format (e.g., JSON)-//-// The output will always be a valid slice but may be of length zero.func ParseArbitraryStringSlice(input string, sep string) []string {-input = strings.TrimSpace(input)-if input == "" {-return []string{}-}-// Try to base64 decode the input. If successful, consider the decoded-// value as input.-inputBytes, err := base64.StdEncoding.DecodeString(input)-if err == nil {-input = string(inputBytes)-}-ret := []string{}-// Try to JSON unmarshal the input. If successful, consider that the-// metadata was supplied as JSON input.-err = json.Unmarshal([]byte(input), &ret)-if err != nil {-// If JSON unmarshalling fails, consider that the input was-// supplied as a separated string of values.-return ParseStringSlice(input, sep)-}-if ret == nil {-return []string{}-}-return ret+return extstrutil.ParseArbitraryStringSlice(input, sep)}// TrimStrings takes a slice of strings and returns a slice of strings-// with trimmed spacesfunc TrimStrings(items []string) []string {-ret := make([]string, len(items))-for i, item := range items {-ret[i] = strings.TrimSpace(item)-}-return ret+return extstrutil.TrimStrings(items)}// RemoveDuplicates removes duplicate and empty elements from a slice of-// strings. This also may convert the items in the slice to lower case and-// returns a sorted slice.func RemoveDuplicates(items []string, lowercase bool) []string {-itemsMap := map[string]bool{}-for _, item := range items {-item = strings.TrimSpace(item)-if lowercase {-item = strings.ToLower(item)-}-if item == "" {-continue-}-itemsMap[item] = true-}-items = make([]string, 0, len(itemsMap))-for item := range itemsMap {-items = append(items, item)-}-sort.Strings(items)-return items+return extstrutil.RemoveDuplicates(items, lowercase)}// RemoveDuplicatesStable removes duplicate and empty elements from a slice of-// strings, preserving order (and case) of the original slice.-// In all cases, strings are compared after trimming whitespace-// If caseInsensitive, strings will be compared after ToLower()func RemoveDuplicatesStable(items []string, caseInsensitive bool) []string {-itemsMap := make(map[string]bool, len(items))-deduplicated := make([]string, 0, len(items))-for _, item := range items {-key := strings.TrimSpace(item)-if caseInsensitive {-key = strings.ToLower(key)-}-if key == "" || itemsMap[key] {-continue-}-itemsMap[key] = true-deduplicated = append(deduplicated, item)-}-return deduplicated+return extstrutil.RemoveDuplicatesStable(items, caseInsensitive)}// RemoveEmpty removes empty elements from a slice of-// stringsfunc RemoveEmpty(items []string) []string {-if len(items) == 0 {-return items-}-itemsSlice := make([]string, 0, len(items))-for _, item := range items {-if item == "" {-continue-}-itemsSlice = append(itemsSlice, item)-}-return itemsSlice+return extstrutil.RemoveEmpty(items)}// EquivalentSlices checks whether the given string sets are equivalent, as in,-// they contain the same values.func EquivalentSlices(a, b []string) bool {-if a == nil && b == nil {-return true-}-if a == nil || b == nil {-return false-}-// First we'll build maps to ensure unique values-mapA := map[string]bool{}-mapB := map[string]bool{}-for _, keyA := range a {-mapA[keyA] = true-}-for _, keyB := range b {-mapB[keyB] = true-}-// Now we'll build our checking slices-var sortedA, sortedB []string-for keyA := range mapA {-sortedA = append(sortedA, keyA)-}-for keyB := range mapB {-sortedB = append(sortedB, keyB)-}-sort.Strings(sortedA)-sort.Strings(sortedB)-// Finally, compare-if len(sortedA) != len(sortedB) {-return false-}-for i := range sortedA {-if sortedA[i] != sortedB[i] {-return false-}-}-return true+return extstrutil.EquivalentSlices(a, b)}// EqualStringMaps tests whether two map[string]string objects are equal.-// Equal means both maps have the same sets of keys and values. This function-// is 6-10x faster than a call to reflect.DeepEqual().func EqualStringMaps(a, b map[string]string) bool {-if len(a) != len(b) {-return false-}-for k := range a {-v, ok := b[k]-if !ok || a[k] != v {-return false-}-}-return true+return extstrutil.EqualStringMaps(a, b)}// StrListDelete removes the first occurrence of the given item from the slice-// of strings if the item exists.func StrListDelete(s []string, d string) []string {-if s == nil {-return s-}-for index, element := range s {-if element == d {-return append(s[:index], s[index+1:]...)-}-}-return s+return extstrutil.StrListDelete(s, d)}// GlobbedStringsMatch compares item to val with support for a leading and/or-// trailing wildcard '*' in item.func GlobbedStringsMatch(item, val string) bool {-if len(item) < 2 {-return val == item-}-hasPrefix := strings.HasPrefix(item, "*")-hasSuffix := strings.HasSuffix(item, "*")-if hasPrefix && hasSuffix {… diff truncated
sdk/helper/parseutil/parseutil.go+10 −278
@@ -1,309 +1,41 @@+// DEPRECATED: this has been moved to go-secure-stdlib and will be removedpackage parseutilimport (-"encoding/json"-"errors"-"fmt"-"regexp"-"strconv"-"strings""time""github.com/hashicorp/errwrap"+extparseutil "github.com/hashicorp/go-secure-stdlib/parseutil"sockaddr "github.com/hashicorp/go-sockaddr"-"github.com/hashicorp/vault/sdk/helper/strutil"-"github.com/mitchellh/mapstructure")var validCapacityString = regexp.MustCompile("^[\t ]*([0-9]+)[\t ]?([kmgtKMGT][iI]?[bB])?[\t ]*$")-// ParseCapacityString parses a capacity string and returns the number of bytes it represents.-// Capacity strings are things like 5gib or 10MB. Supported prefixes are kb, kib, mb, mib, gb,-// gib, tb, tib, which are not case sensitive. If no prefix is present, the number is assumed-// to be in bytes already.func ParseCapacityString(in interface{}) (uint64, error) {-var cap uint64-jsonIn, ok := in.(json.Number)-if ok {-in = jsonIn.String()-}-switch inp := in.(type) {-case nil:-// return default of zero-case string:-if inp == "" {-return cap, nil-}-matches := validCapacityString.FindStringSubmatch(inp)-// no sub-groups means we couldn't parse it-if len(matches) <= 1 {-return cap, errors.New("could not parse capacity from input")-}-var multiplier uint64 = 1-switch strings.ToLower(matches[2]) {-case "kb":-multiplier = 1000-case "kib":-multiplier = 1024-case "mb":-multiplier = 1000 * 1000-case "mib":-multiplier = 1024 * 1024-case "gb":-multiplier = 1000 * 1000 * 1000-case "gib":-multiplier = 1024 * 1024 * 1024-case "tb":-multiplier = 1000 * 1000 * 1000 * 1000-case "tib":-multiplier = 1024 * 1024 * 1024 * 1024-}-size, err := strconv.ParseUint(matches[1], 10, 64)-if err != nil {-return cap, err-}-cap = size * multiplier-case int:-cap = uint64(inp)-case int32:-cap = uint64(inp)-case int64:-cap = uint64(inp)-case uint:-cap = uint64(inp)-case uint32:-cap = uint64(inp)-case uint64:-cap = uint64(inp)-case float32:-cap = uint64(inp)-case float64:-cap = uint64(inp)-default:-return cap, errors.New("could not parse capacity from input")-}-return cap, nil+return extparseutil.ParseCapacityString(in)}func ParseDurationSecond(in interface{}) (time.Duration, error) {-var dur time.Duration-jsonIn, ok := in.(json.Number)-if ok {-in = jsonIn.String()-}-switch inp := in.(type) {-case nil:-// return default of zero-case string:-if inp == "" {-return dur, nil-}-var err error-// Look for a suffix otherwise its a plain second value-if strings.HasSuffix(inp, "s") || strings.HasSuffix(inp, "m") || strings.HasSuffix(inp, "h") || strings.HasSuffix(inp, "ms") {-dur, err = time.ParseDuration(inp)-if err != nil {-return dur, err-}-} else {-// Plain integer-secs, err := strconv.ParseInt(inp, 10, 64)-if err != nil {-return dur, err-}-dur = time.Duration(secs) * time.Second-}-case int:-dur = time.Duration(inp) * time.Second-case int32:-dur = time.Duration(inp) * time.Second-case int64:-dur = time.Duration(inp) * time.Second-case uint:-dur = time.Duration(inp) * time.Second-case uint32:-dur = time.Duration(inp) * time.Second-case uint64:-dur = time.Duration(inp) * time.Second-case float32:-dur = time.Duration(inp) * time.Second-case float64:-dur = time.Duration(inp) * time.Second-case time.Duration:-dur = inp-default:-return 0, errors.New("could not parse duration from input")-}-return dur, nil+return extparseutil.ParseDurationSecond(in)}func ParseAbsoluteTime(in interface{}) (time.Time, error) {-var t time.Time-switch inp := in.(type) {-case nil:-// return default of zero-return t, nil-case string:-// Allow RFC3339 with nanoseconds, or without,-// or an epoch time as an integer.-var err error-t, err = time.Parse(time.RFC3339Nano, inp)-if err == nil {-break-}-t, err = time.Parse(time.RFC3339, inp)-if err == nil {-break-}-epochTime, err := strconv.ParseInt(inp, 10, 64)-if err == nil {-t = time.Unix(epochTime, 0)-break-}-return t, errors.New("could not parse string as date and time")-case json.Number:-epochTime, err := inp.Int64()-if err != nil {-return t, err-}-t = time.Unix(epochTime, 0)-case int:-t = time.Unix(int64(inp), 0)-case int32:-t = time.Unix(int64(inp), 0)-case int64:-t = time.Unix(inp, 0)-case uint:-t = time.Unix(int64(inp), 0)-case uint32:-t = time.Unix(int64(inp), 0)-case uint64:-t = time.Unix(int64(inp), 0)-default:-return t, errors.New("could not parse time from input type")-}-return t, nil+return extparseutil.ParseAbsoluteTime(in)}func ParseInt(in interface{}) (int64, error) {-var ret int64-jsonIn, ok := in.(json.Number)-if ok {-in = jsonIn.String()-}-switch in.(type) {-case string:-inp := in.(string)-if inp == "" {-return 0, nil-}-var err error-left, err := strconv.ParseInt(inp, 10, 64)-if err != nil {-return ret, err-}-ret = left-case int:-ret = int64(in.(int))-case int32:-ret = int64(in.(int32))-case int64:-ret = in.(int64)-case uint:-ret = int64(in.(uint))-case uint32:-ret = int64(in.(uint32))-case uint64:-ret = int64(in.(uint64))-default:-return 0, errors.New("could not parse value from input")-}-return ret, nil+return extparseutil.ParseInt(in)}func ParseBool(in interface{}) (bool, error) {-var result bool-if err := mapstructure.WeakDecode(in, &result); err != nil {-return false, err-}-return result, nil+return extparseutil.ParseBool(in)}func ParseString(in interface{}) (string, error) {-var result string-if err := mapstructure.WeakDecode(in, &result); err != nil {-return "", err-}-return result, nil+return extparseutil.ParseString(in)}func ParseCommaStringSlice(in interface{}) ([]string, error) {-rawString, ok := in.(string)-if ok && rawString == "" {-return []string{}, nil-}-var result []string-config := &mapstructure.DecoderConfig{-Result: &result,-WeaklyTypedInput: true,-DecodeHook: mapstructure.StringToSliceHookFunc(","),-}-decoder, err := mapstructure.NewDecoder(config)-if err != nil {-return nil, err-}-if err := decoder.Decode(in); err != nil {-return nil, err-}-return strutil.TrimStrings(result), nil+return extparseutil.ParseCommaStringSlice(in)}func ParseAddrs(addrs interface{}) ([]*sockaddr.SockAddrMarshaler, error) {-out := make([]*sockaddr.SockAddrMarshaler, 0)-stringAddrs := make([]string, 0)-switch addrs.(type) {-case string:-stringAddrs = strutil.ParseArbitraryStringSlice(addrs.(string), ",")-if len(stringAddrs) == 0 {-return nil, fmt.Errorf("unable to parse addresses from %v", addrs)-}-case []string:-stringAddrs = addrs.([]string)-case []interface{}:-for _, v := range addrs.([]interface{}) {-stringAddr, ok := v.(string)-if !ok {-return nil, fmt.Errorf("error parsing %v as string", v)-}-stringAddrs = append(stringAddrs, stringAddr)-}-default:-return nil, fmt.Errorf("unknown address input type %T", addrs)-}-for _, addr := range stringAddrs {-sa, err := sockaddr.NewSockAddr(addr)-if err != nil {-return nil, errwrap.Wrapf(fmt.Sprintf("error parsing address %q: {{err}}", addr), err)-}-out = append(out, &sockaddr.SockAddrMarshaler{-SockAddr: sa,-})-}-return out, nil+return extparseutil.ParseAddrs(addrs)}
sdk/helper/tlsutil/tlsutil.go+9 −215
@@ -1,238 +1,32 @@+// DEPRECATED: this has been moved to go-secure-stdlib and will be removedpackage tlsutilimport ("crypto/tls"-"crypto/x509"-"errors"-"fmt"-"io/ioutil"-"net"-"strings""github.com/hashicorp/errwrap"-"github.com/hashicorp/vault/sdk/helper/parseutil"-"github.com/hashicorp/vault/sdk/helper/strutil"+exttlsutil "github.com/hashicorp/go-secure-stdlib/tlsutil")var ErrInvalidCertParams = errors.New("invalid certificate parameters")+var ErrInvalidCertParams = exttlsutil.ErrInvalidCertParams// TLSLookup maps the tls_min_version configuration to the internal value-var TLSLookup = map[string]uint16{-"tls10": tls.VersionTLS10,-"tls11": tls.VersionTLS11,-"tls12": tls.VersionTLS12,-"tls13": tls.VersionTLS13,-}-// cipherMap maps the cipher suite names to the internal cipher suite code.-var cipherMap = map[string]uint16{-"TLS_RSA_WITH_RC4_128_SHA": tls.TLS_RSA_WITH_RC4_128_SHA,-"TLS_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA,-"TLS_RSA_WITH_AES_128_CBC_SHA": tls.TLS_RSA_WITH_AES_128_CBC_SHA,-"TLS_RSA_WITH_AES_256_CBC_SHA": tls.TLS_RSA_WITH_AES_256_CBC_SHA,-"TLS_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_RSA_WITH_AES_128_CBC_SHA256,-"TLS_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_RSA_WITH_AES_128_GCM_SHA256,-"TLS_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_RSA_WITH_AES_256_GCM_SHA384,-"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,-"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,-"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,-"TLS_ECDHE_RSA_WITH_RC4_128_SHA": tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA,-"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,-"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,-"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA": tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,-"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,-"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,-"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,-"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,-"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,-"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,-"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,-"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,-"TLS_AES_128_GCM_SHA256": tls.TLS_AES_128_GCM_SHA256,-"TLS_AES_256_GCM_SHA384": tls.TLS_AES_256_GCM_SHA384,-"TLS_CHACHA20_POLY1305_SHA256": tls.TLS_CHACHA20_POLY1305_SHA256,-}+var TLSLookup = exttlsutil.TLSLookup// ParseCiphers parse ciphersuites from the comma-separated string into recognized slicefunc ParseCiphers(cipherStr string) ([]uint16, error) {-suites := []uint16{}-ciphers := strutil.ParseStringSlice(cipherStr, ",")-for _, cipher := range ciphers {-if v, ok := cipherMap[cipher]; ok {-suites = append(suites, v)-} else {-return suites, fmt.Errorf("unsupported cipher %q", cipher)-}-}-return suites, nil+return exttlsutil.ParseCiphers(cipherStr)}// GetCipherName returns the name of a given cipher suite code or an error if the-// given cipher is unsupported.func GetCipherName(cipher uint16) (string, error) {-for cipherStr, cipherCode := range cipherMap {-if cipherCode == cipher {-return cipherStr, nil-}-}-return "", fmt.Errorf("unsupported cipher %d", cipher)+return exttlsutil.GetCipherName(cipher)}// ClientTLSConfig parses the CA certificate, and optionally a public/private-// client certificate key pair. The certificates must be in PEM encoded format.func ClientTLSConfig(caCert []byte, clientCert []byte, clientKey []byte) (*tls.Config, error) {-var tlsConfig *tls.Config-var pool *x509.CertPool-switch {-case len(caCert) != 0:-// Valid-case len(clientCert) != 0 && len(clientKey) != 0:-// Valid-default:-return nil, ErrInvalidCertParams-}-if len(caCert) != 0 {-pool = x509.NewCertPool()-pool.AppendCertsFromPEM(caCert)-}-tlsConfig = &tls.Config{-RootCAs: pool,-ClientAuth: tls.RequireAndVerifyClientCert,-MinVersion: tls.VersionTLS12,-}-var cert tls.Certificate-var err error-if len(clientCert) != 0 && len(clientKey) != 0 {-cert, err = tls.X509KeyPair(clientCert, clientKey)-if err != nil {-return nil, err-}-tlsConfig.Certificates = []tls.Certificate{cert}-}-tlsConfig.BuildNameToCertificate()-return tlsConfig, nil+return exttlsutil.ClientTLSConfig(caCert, clientCert, clientKey)}// LoadClientTLSConfig loads and parse the CA certificate, and optionally a-// public/private client certificate key pair. The certificates must be in PEM-// encoded format.func LoadClientTLSConfig(caCert, clientCert, clientKey string) (*tls.Config, error) {-var tlsConfig *tls.Config-var pool *x509.CertPool-switch {-case len(caCert) != 0:-// Valid-case len(clientCert) != 0 && len(clientKey) != 0:-// Valid-default:-return nil, ErrInvalidCertParams-}-if len(caCert) != 0 {-pool = x509.NewCertPool()-data, err := ioutil.ReadFile(caCert)-if err != nil {-return nil, errwrap.Wrapf("failed to read CA file: {{err}}", err)-}-if !pool.AppendCertsFromPEM(data) {-return nil, fmt.Errorf("failed to parse CA certificate")-}-}-tlsConfig = &tls.Config{-RootCAs: pool,-ClientAuth: tls.RequireAndVerifyClientCert,-MinVersion: tls.VersionTLS12,-}-var cert tls.Certificate-var err error-if len(clientCert) != 0 && len(clientKey) != 0 {-cert, err = tls.LoadX509KeyPair(clientCert, clientKey)-if err != nil {-return nil, err-}-tlsConfig.Certificates = []tls.Certificate{cert}-}-tlsConfig.BuildNameToCertificate()-return tlsConfig, nil+return exttlsutil.LoadClientTLSConfig(caCert, clientCert, clientKey)}func SetupTLSConfig(conf map[string]string, address string) (*tls.Config, error) {-serverName, _, err := net.SplitHostPort(address)-switch {-case err == nil:-case strings.Contains(err.Error(), "missing port"):-serverName = conf["address"]-default:-return nil, err-}-insecureSkipVerify := false-tlsSkipVerify := conf["tls_skip_verify"]-if tlsSkipVerify != "" {-b, err := parseutil.ParseBool(tlsSkipVerify)-if err != nil {-return nil, errwrap.Wrapf("failed parsing tls_skip_verify parameter: {{err}}", err)-}-insecureSkipVerify = b-}-tlsMinVersionStr, ok := conf["tls_min_version"]-if !ok {-// Set the default value-tlsMinVersionStr = "tls12"-}-tlsMinVersion, ok := TLSLookup[tlsMinVersionStr]-if !ok {-return nil, fmt.Errorf("invalid 'tls_min_version'")-}-tlsClientConfig := &tls.Config{-MinVersion: tlsMinVersion,-InsecureSkipVerify: insecureSkipVerify,-ServerName: serverName,-}-_, okCert := conf["tls_cert_file"]-_, okKey := conf["tls_key_file"]-if okCert && okKey {-tlsCert, err := tls.LoadX509KeyPair(conf["tls_cert_file"], conf["tls_key_file"])-if err != nil {-return nil, errwrap.Wrapf("client tls setup failed: {{err}}", err)-}-tlsClientConfig.Certificates = []tls.Certificate{tlsCert}-} else if okCert || okKey {-return nil, fmt.Errorf("both tls_cert_file and tls_key_file must be provided")-}-if tlsCaFile, ok := conf["tls_ca_file"]; ok {-caPool := x509.NewCertPool()-data, err := ioutil.ReadFile(tlsCaFile)-if err != nil {-return nil, errwrap.Wrapf("failed to read CA file: {{err}}", err)-}-if !caPool.AppendCertsFromPEM(data) {-return nil, fmt.Errorf("failed to parse CA certificate")-}-tlsClientConfig.RootCAs = caPool-}-return tlsClientConfig, nil+return exttlsutil.SetupTLSConfig(conf, address)}
go.sum+2 −2
@@ -703,8 +703,8 @@ github.com/hashicorp/vault-plugin-auth-jwt v0.10.0 h1:9jzAxMnhTA0xsDE3p7IzUoa9O5github.com/hashicorp/vault-plugin-auth-jwt v0.10.0/go.mod h1:3KxfehLIM7zH19+O8jHJ/QJsLGRzSKRqjsesOJmBuoI=github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0 h1:7M7/DbFsUoOMBd2/R48ZNj4PM3Gdsg0dGcbMOdt5z1Q=github.com/hashicorp/vault-plugin-auth-kerberos v0.4.0/go.mod h1:h+7pLm4Z2EeKHOGPefX0bGzdUQCMBUlvM/BpSMNgTFw=-github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.0 h1:r29XoFK6qj9Kzl1m7xXNJmsCZ6fp88jSq/XMJk/QmoI=-github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.0/go.mod h1:2c/k3nsoGPKV+zpAWCiajt4e66vncEq8Li/eKLqErAc=+github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1 h1:7c2ufXt5oXSUISNHpO07W956fpgn00nT1IQFPEP5XQE=+github.com/hashicorp/vault-plugin-auth-kubernetes v0.10.1/go.mod h1:2c/k3nsoGPKV+zpAWCiajt4e66vncEq8Li/eKLqErAc=github.com/hashicorp/vault-plugin-auth-oci v0.8.0 h1:qYtVYsQlVnqqlCVqZ+CAiFEXuYJqUQCuqcWQVELybZY=github.com/hashicorp/vault-plugin-auth-oci v0.8.0/go.mod h1:Cn5cjR279Y+snw8LTaiLTko3KGrbigRbsQPOd2D5xDw=github.com/hashicorp/vault-plugin-database-couchbase v0.4.0 h1:N5ChjecnC88mRfT9KehoeSK6xEyzGoL6g9HJnSZKgII=TestLogical_RequestSizeLimit (#12093)api/response.go | 18 +++---------------changelog/12061.txt | 3 ---http/handler.go | 5 +----sdk/logical/response_util.go | 10 ----------vault/logical_system.go | 7 +------5 files changed, 5 insertions(+), 38 deletions(-)delete mode 100644 changelog/12061.txt
builtin/credential/approle/path_role.go+2 −2
@@ -7,14 +7,14 @@ import ("strings""time""github.com/hashicorp/go-secure-stdlib/parseutil"+"github.com/hashicorp/go-secure-stdlib/strutil"uuid "github.com/hashicorp/go-uuid""github.com/hashicorp/vault/sdk/framework""github.com/hashicorp/vault/sdk/helper/cidrutil""github.com/hashicorp/vault/sdk/helper/consts""github.com/hashicorp/vault/sdk/helper/locksutil"-"github.com/hashicorp/vault/sdk/helper/parseutil""github.com/hashicorp/vault/sdk/helper/policyutil"-"github.com/hashicorp/vault/sdk/helper/strutil""github.com/hashicorp/vault/sdk/helper/tokenutil""github.com/hashicorp/vault/sdk/logical")
builtin/credential/github/cli.go+1 −1
@@ -6,8 +6,8 @@ import ("os""strings""github.com/hashicorp/go-secure-stdlib/password""github.com/hashicorp/vault/api"-"github.com/hashicorp/vault/sdk/helper/password")type CLIHandler struct {
.circleci/config.yml+118 −37
@@ -21,6 +21,9 @@ jobs:- restore_cache:key: package-2ffbc24c482a71c7f16a87ad5cc6c01038544fe3-{{checksum ".buildcache/cache-keys/package-2ffbc24c482a71c7f16a87ad5cc6c01038544fe3"}}name: Restore package cache+- restore_cache:+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Restore package cache- restore_cache:key: package-61f4e059780eac8772bed584d10749860f2fdce1-{{checksum ".buildcache/cache-keys/package-61f4e059780eac8772bed584d10749860f2fdce1"}}name: Restore package cache@@ -73,20 +76,20 @@ jobs:command: ls -lahR .buildcachename: List Build Cache- run:-command: cp packages*.lock/pkgs.yml lockfile-7d1b28ede60990fa.yml+command: cp packages*.lock/pkgs.yml lockfile-e0096d0cd2ca1c5a.ymlname: Update Lockfile Name- run:-command: tar -czf packages-7d1b28ede60990fa.tar.gz .buildcache/packages lockfile-7d1b28ede60990fa.yml+command: tar -czf packages-e0096d0cd2ca1c5a.tar.gz .buildcache/packages lockfile-e0096d0cd2ca1c5a.ymlname: Create Raw Package Tarball- run:-command: tar -czf meta-7d1b28ede60990fa.tar.gz .buildcache/packages/store/*.json lockfile-7d1b28ede60990fa.yml+command: tar -czf meta-e0096d0cd2ca1c5a.tar.gz .buildcache/packages/store/*.json lockfile-e0096d0cd2ca1c5a.ymlname: Create Metadata Tarball- store_artifacts:-path: lockfile-7d1b28ede60990fa.yml+path: lockfile-e0096d0cd2ca1c5a.yml- store_artifacts:-path: packages-7d1b28ede60990fa.tar.gz+path: packages-e0096d0cd2ca1c5a.tar.gz- store_artifacts:-path: meta-7d1b28ede60990fa.tar.gz+path: meta-e0096d0cd2ca1c5a.tar.gz- store_artifacts:path: .buildcache/packagesenvironment:@@ -108,7 +111,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -150,7 +153,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -171,6 +174,84 @@ jobs:name: Save package cachepaths:- .buildcache/packages/store+darwin_arm64_package:+docker:+- image: docker.mirror.hashicorp.services/circleci/buildpack-deps+shell: /usr/bin/env bash -euo pipefail -c+environment:+- AUTO_INSTALL_TOOLS: 'YES'+- BUILDKIT_PROGRESS: plain+- PRODUCT_REVISION: ''+- PACKAGE_SPEC_ID: 2ee966c5768e83a92093c0bc6a2fc6042afe4839+steps:+- setup_remote_docker:+docker_layer_caching: false+version: 19.03.12+- add_ssh_keys:+fingerprints:+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98+- checkout:+path: .+- run:+command: make -C packages*.lock write-package-cache-key+name: Write package cache key+- restore_cache:+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Restore package cache+- run:+command: |2+if ! { PKG=$(find .buildcache/packages/store -maxdepth 1 -mindepth 1 -name '*.zip' 2> /dev/null) && [ -n "$PKG" ]; }; then+echo "No package found, continuing with build."+exit 0+fi+echo "Package already cached, skipping build."+circleci-agent step halt+name: Check cache status+- run:+command: make -C packages*.lock write-builder-cache-keys+name: Write builder layer cache keys+- restore_cache:+key: copy-source_01bb_{{checksum ".buildcache/cache-keys/copy-source-01bb587fbaa40eee3270a2dfa7865a8e37dde482"}}+keys:+- go-modules_87d5_{{checksum ".buildcache/cache-keys/go-modules-87d5fe370bb634974f7b55a067206409c85d5947"}}+- build-static-assets_c9eb_{{checksum ".buildcache/cache-keys/build-static-assets-c9eb755a774c85539457676828158a137604f20d"}}+- build-ui_f5d8_{{checksum ".buildcache/cache-keys/build-ui-f5d8c1975b103bbe13e2841b5e8a5d1a11c96e78"}}+- ui-dependencies_ac8b_{{checksum ".buildcache/cache-keys/ui-dependencies-ac8be120c6d5a16da43fee57c2cecb19a70f8098"}}+- install-yarn_3ec0_{{checksum ".buildcache/cache-keys/install-yarn-3ec09455a50e67ce0e6b9f03e2cefa3e97333a5b"}}+- set-workdir_3310_{{checksum ".buildcache/cache-keys/set-workdir-331006d1434fd1975dad2affbf71fdbf845d22d6"}}+- install-go-tools_dcaa_{{checksum ".buildcache/cache-keys/install-go-tools-dcaa9bb2de49ba79e84aa2ec9e02018c05e62950"}}+- install-go_d552_{{checksum ".buildcache/cache-keys/install-go-d55278f9cd49b917d025adaeed3032cc8b0dc7d7"}}+- base_c6cd_{{checksum ".buildcache/cache-keys/base-c6cdf1b224722d2520e082320f2a71875913247c"}}+name: 'Restore Builder Image Cache: copy-source'+- run:+command: make -C packages*.lock load-builder-cache+name: Load whatever builder cache we have (if any) into the Docker daemon+no_output_timeout: 30m+- run:+command: |2-+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"+eval "$(ssh-agent -s)"+if [ -f "$KEYFILE" ]; then+ssh-add "$KEYFILE"+else+echo "==> INFO: SSH key for github.com not found"+echo " Attempts to access private repositories from within"+echo " the build will fail, e.g. for private go modules, or"+echo " attempts to directly clone private repositories."+fi+make -C packages*.lock package+name: Compile Package+- run:+command: ls -lahR .buildcache/packages+name: List packages+- save_cache:+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Save package cache+paths:+- .buildcache/packages/storewindows_386_package:docker:- image: docker.mirror.hashicorp.services/circleci/buildpack-deps@@ -186,7 +267,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -228,7 +309,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -278,7 +359,7 @@ jobs:steps:- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -303,7 +384,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -319,7 +400,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -335,7 +416,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -351,7 +432,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -367,7 +448,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -383,7 +464,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -399,7 +480,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -415,7 +496,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -431,7 +512,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -447,7 +528,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -463,7 +544,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -500,7 +581,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -542,7 +623,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -631,7 +712,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -673,7 +754,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -792,7 +873,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -834,7 +915,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -1052,7 +1133,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -1094,7 +1175,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -1302,7 +1383,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -1344,7 +1425,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -1380,7 +1461,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -1422,7 +1503,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -1458,7 +1539,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -1500,7 +1581,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -1559,7 +1640,7 @@ jobs:version: 19.03.12- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .… diff truncated
.circleci/config/@build-release.yml+113 −37
@@ -23,7 +23,7 @@ jobs:steps:- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -48,7 +48,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -64,7 +64,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -80,7 +80,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -96,7 +96,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -112,7 +112,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -128,7 +128,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -144,7 +144,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -160,7 +160,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -176,7 +176,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -192,7 +192,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -208,7 +208,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -240,6 +240,9 @@ jobs:- restore_cache:key: package-2ffbc24c482a71c7f16a87ad5cc6c01038544fe3-{{checksum ".buildcache/cache-keys/package-2ffbc24c482a71c7f16a87ad5cc6c01038544fe3"}}name: Restore package cache+- restore_cache:+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Restore package cache- restore_cache:key: package-61f4e059780eac8772bed584d10749860f2fdce1-{{checksum ".buildcache/cache-keys/package-61f4e059780eac8772bed584d10749860f2fdce1"}}name: Restore package cache@@ -292,20 +295,20 @@ jobs:command: ls -lahR .buildcachename: List Build Cache- run:-command: cp packages*.lock/pkgs.yml lockfile-7d1b28ede60990fa.yml+command: cp packages*.lock/pkgs.yml lockfile-e0096d0cd2ca1c5a.ymlname: Update Lockfile Name- run:-command: tar -czf packages-7d1b28ede60990fa.tar.gz .buildcache/packages lockfile-7d1b28ede60990fa.yml+command: tar -czf packages-e0096d0cd2ca1c5a.tar.gz .buildcache/packages lockfile-e0096d0cd2ca1c5a.ymlname: Create Raw Package Tarball- run:-command: tar -czf meta-7d1b28ede60990fa.tar.gz .buildcache/packages/store/*.json lockfile-7d1b28ede60990fa.yml+command: tar -czf meta-e0096d0cd2ca1c5a.tar.gz .buildcache/packages/store/*.json lockfile-e0096d0cd2ca1c5a.ymlname: Create Metadata Tarball- store_artifacts:-path: lockfile-7d1b28ede60990fa.yml+path: lockfile-e0096d0cd2ca1c5a.yml- store_artifacts:-path: packages-7d1b28ede60990fa.tar.gz+path: packages-e0096d0cd2ca1c5a.tar.gz- store_artifacts:-path: meta-7d1b28ede60990fa.tar.gz+path: meta-e0096d0cd2ca1c5a.tar.gz- store_artifacts:path: .buildcache/packagesdarwin_amd64_package:@@ -316,7 +319,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -358,7 +361,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -381,6 +384,79 @@ jobs:name: Save package cacheenvironment:PACKAGE_SPEC_ID: 2ffbc24c482a71c7f16a87ad5cc6c01038544fe3+darwin_arm64_package:+executor: builder+steps:+- setup_remote_docker:+version: 19.03.12+docker_layer_caching: false+- add_ssh_keys:+fingerprints:+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98+- checkout:+path: .+- run:+command: make -C packages*.lock write-package-cache-key+name: Write package cache key+- restore_cache:+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Restore package cache+- run:+command: |2+if ! { PKG=$(find .buildcache/packages/store -maxdepth 1 -mindepth 1 -name '*.zip' 2> /dev/null) && [ -n "$PKG" ]; }; then+echo "No package found, continuing with build."+exit 0+fi+echo "Package already cached, skipping build."+circleci-agent step halt+name: Check cache status+- run:+command: make -C packages*.lock write-builder-cache-keys+name: Write builder layer cache keys+- restore_cache:+key: copy-source_01bb_{{checksum ".buildcache/cache-keys/copy-source-01bb587fbaa40eee3270a2dfa7865a8e37dde482"}}+keys:+- go-modules_87d5_{{checksum ".buildcache/cache-keys/go-modules-87d5fe370bb634974f7b55a067206409c85d5947"}}+- build-static-assets_c9eb_{{checksum ".buildcache/cache-keys/build-static-assets-c9eb755a774c85539457676828158a137604f20d"}}+- build-ui_f5d8_{{checksum ".buildcache/cache-keys/build-ui-f5d8c1975b103bbe13e2841b5e8a5d1a11c96e78"}}+- ui-dependencies_ac8b_{{checksum ".buildcache/cache-keys/ui-dependencies-ac8be120c6d5a16da43fee57c2cecb19a70f8098"}}+- install-yarn_3ec0_{{checksum ".buildcache/cache-keys/install-yarn-3ec09455a50e67ce0e6b9f03e2cefa3e97333a5b"}}+- set-workdir_3310_{{checksum ".buildcache/cache-keys/set-workdir-331006d1434fd1975dad2affbf71fdbf845d22d6"}}+- install-go-tools_dcaa_{{checksum ".buildcache/cache-keys/install-go-tools-dcaa9bb2de49ba79e84aa2ec9e02018c05e62950"}}+- install-go_d552_{{checksum ".buildcache/cache-keys/install-go-d55278f9cd49b917d025adaeed3032cc8b0dc7d7"}}+- base_c6cd_{{checksum ".buildcache/cache-keys/base-c6cdf1b224722d2520e082320f2a71875913247c"}}+name: 'Restore Builder Image Cache: copy-source'+- run:+command: make -C packages*.lock load-builder-cache+name: Load whatever builder cache we have (if any) into the Docker daemon+no_output_timeout: 30m+- run:+command: |2-+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"+eval "$(ssh-agent -s)"+if [ -f "$KEYFILE" ]; then+ssh-add "$KEYFILE"+else+echo "==> INFO: SSH key for github.com not found"+echo " Attempts to access private repositories from within"+echo " the build will fail, e.g. for private go modules, or"+echo " attempts to directly clone private repositories."+fi+make -C packages*.lock package+name: Compile Package+- run:+command: ls -lahR .buildcache/packages+name: List packages+- save_cache:+paths:+- .buildcache/packages/store+key: package-2ee966c5768e83a92093c0bc6a2fc6042afe4839-{{checksum ".buildcache/cache-keys/package-2ee966c5768e83a92093c0bc6a2fc6042afe4839"}}+name: Save package cache+environment:+PACKAGE_SPEC_ID: 2ee966c5768e83a92093c0bc6a2fc6042afe4839freebsd_386_package:executor: buildersteps:@@ -389,7 +465,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -431,7 +507,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -462,7 +538,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -504,7 +580,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -535,7 +611,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -577,7 +653,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -608,7 +684,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -650,7 +726,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -681,7 +757,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -723,7 +799,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -754,7 +830,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -796,7 +872,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -827,7 +903,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -869,7 +945,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -900,7 +976,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -942,7 +1018,7 @@ jobs:- run:command: |2-KEYFILE="$HOME/.ssh/id_rsa_0e0377f4e2c356c2536a03e131912f06"+KEYFILE="$HOME/.ssh/id_rsa_c6969882dc046c39ddac8305e3151c98"eval "$(ssh-agent -s)"if [ -f "$KEYFILE" ]; thenssh-add "$KEYFILE"@@ -973,7 +1049,7 @@ jobs:docker_layer_caching: false- add_ssh_keys:fingerprints:-- 0e:03:77:f4:e2:c3:56:c2:53:6a:03:e1:31:91:2f:06+- c6:96:98:82:dc:04:6c:39:dd:ac:83:05:e3:15:1c:98- checkout:path: .- run:@@ -1015,7 +1091,7 @@ jobs:- run:command: |2-
website/content/docs/secrets/identity.mdx+11 −11
@@ -65,7 +65,7 @@ applicable to the token through its identity will happen at request time. Thisalso adds enormous flexibility to control the behavior of already issuedtokens.Its important to note that the policies on the entity are only a means to grant+It is important to note that the policies on the entity are only a means to grant_additional_ capabilities and not a replacement for the policies on the token.To know the full set of capabilities of the token with an associated entityidentifier, the policies on the token should be taken into account.@@ -128,7 +128,7 @@ token using a token role with a configured list of `allowed_entity_aliases`.### Identity AuditingIf the token used to make API calls have an associated entity identifier, it+If the token used to make API calls has an associated entity identifier, itwill be audit logged as well. This leaves a trail of actions performed byspecific users.@@ -136,10 +136,10 @@ specific users.In version 0.9, Vault identity has support for groups. A group can containmultiple entities as its members. A group can also have subgroups. Policies set-on the group is granted to all members of the group. During request time, when+on the group are granted to all members of the group. During request time, whenthe token's entity ID is being evaluated for the policies that it has access-to; along with the policies on the entity itself, policies that are inherited-due to group memberships are also granted.+to, policies that are inherited due to group memberships are granted along+with the policies on the entity itself.### Group Hierarchical Permissions@@ -154,11 +154,11 @@ to policies on both GroupA and GroupB.By default, the groups created in identity store are called the internalgroups. The membership management of these groups should be carried outmanually. A group can also be created as an external group. In this case, the-entity membership in the group is managed semi-automatically. External group+entity membership in the group is managed semi-automatically. An external groupserves as a mapping to a group that is outside of the identity store. Externalgroups can have one (and only one) alias. This alias should map to a notion of-group that is outside of the identity store. For example, groups in LDAP, and-teams in GitHub. A username in LDAP, belonging to a group in LDAP, can get its+a group that is outside of the identity store. For example, groups in LDAP and+teams in GitHub. A username in LDAP belonging to a group in LDAP can get itsentity ID added as a member of a group in Vault automatically during _logins_and _token renewals_. This works only if the group in Vault is an externalgroup and has an alias that maps to the group in LDAP. If the user is removed@@ -174,7 +174,7 @@ tokens are signed JWTs following the [OIDC IDtoken](https://openid.net/specs/openid-connect-core-1_0.html#IDToken) structure.The public keys used to authenticate the tokens are published by Vault on anunauthenticated endpoint following OIDC discovery and JWKS conventions, which-should be a directly usable by JWT/OIDC libraries. An introspection endpoint is+should be directly usable by JWT/OIDC libraries. An introspection endpoint isalso provided by Vault for token verification.### Roles and Keys@@ -194,7 +194,7 @@ may refer to the same key). It is not possible to generate an unsigned ID token.A named key is a public/private key pair generated by Vault. The private key isused to sign the identity tokens, and the public key is used by clients to-verify the signature. Key are regularly rotated, whereby a new key pair is+verify the signature. Keys are regularly rotated, whereby a new key pair isgenerated and the previous _public_ key is retained for a limited time forverification purposes.@@ -202,7 +202,7 @@ A named key's configuration specifies a rotation period, a verification ttl,signing algorithm and allowed client IDs. Rotation period specifies thefrequency at which a new signing key is generated and the private portion of theprevious signing key is deleted. Verification ttl is the time a public key is-retained for verification, after being rotated. By default, keys are rotated+retained for verification after being rotated. By default, keys are rotatedevery 24 hours, and continue to be available for verification for 24 hours aftertheir rotation.api/response.go | 18 +++++++++++++++---changelog/12061.txt | 3 +++http/handler.go | 5 ++++-sdk/logical/response_util.go | 10 ++++++++++vault/logical_system.go | 7 ++++++-5 files changed, 38 insertions(+), 5 deletions(-)create mode 100644 changelog/12061.txt
More files changed — see the full commit.
Release delta 1.10.0 → 1.10.6 (contains the fix)
website/content/docs/secrets/identity/oidc-provider.mdx+128 −96
@@ -7,130 +7,162 @@ description: >-# OIDC Identity Provider~> **Note:** This feature is currently a ***Tech Preview*** and not recommended-for deployment in production.-Vault as an OIDC identity provider allows clients speaking the OIDC protocol to-take advantage of Vault's various authentication methods and source of-identity. Clients can configure their authentication logic to talk to Vault.-Once enabled, Vault will act as the bridge to identity providers via its-existing authentication methods. Clients will also obtain identity information-for their end-users by leveraging custom templating of Vault identity-information. For more information on the configuration resources and OIDC endpoints,+Vault is an OpenID Connect ([OIDC](https://openid.net/specs/openid-connect-core-1_0.html))+identity provider. This enables client applications that speak the OIDC protocol to leverage+Vault's source of [identity](/docs/concepts/identity) and wide range of [authentication methods](/docs/auth)+when authenticating end-users. Client applications can configure their authentication logic+to talk to Vault. Once enabled, Vault will act as the bridge to other identity providers via+its existing authentication methods. Client applications can also obtain identity information+for their end-users by leveraging custom templating of Vault identity information.+-> **Note**: For more detailed information on the configuration resources and OIDC endpoints,please visit the [OIDC provider](/docs/concepts/oidc-provider) concepts page.The Vault OIDC provider feature currently only supports the-[authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).-## OIDC Provider Configuration+## SetupThe Vault OIDC provider system is built on top of the identity secrets engine.This secrets engine is mounted by default and cannot be disabled or moved.Most secrets engines must be configured in advance before they can perform-their functions. These steps are usually completed by an operator or-configuration management tool.+Each Vault namespace has a default OIDC [provider](/docs/concepts/oidc-provider#providers)+and [key](/docs/concepts/oidc-provider#key). This built-in configuration enables client+applications to begin using Vault as a source of identity with minimal configuration. For+details on the built-in configuration and advanced options, see the [OIDC provider](/docs/concepts/oidc-provider)+concepts page.1. Create a key that will be used to sign/verify ID tokens:-```text-$ vault write identity/oidc/key/my-key \-allowed_client_ids="xxAQWBYzD2WXsB8GiZqwq4jsUwfG0hJV" \-verification_ttl="1h" \-rotation_period="1h" \-algorithm="RS256"-Success! Data written to: identity/oidc/key/my-key-```+The following steps show a minimal configuration that allows a client application to use+Vault as an OIDC provider.1. Create an assignment. This specifies which Vault entities and groups are-authorized to use a specific OIDC client for authentication flows:+1. Enable a Vault auth method:```text-$ vault write identity/oidc/assignment/my-assignment \-group_ids="b6ea7804-acbd-e866-7c51-0896456bd4bb" \-entity_ids="aa786a7a-da2f-dca7-3680-0710771cca51"-Success! Data written to: identity/oidc/assignment/my-assignment+$ vault auth enable userpass+Success! Enabled userpass auth method at: userpass/```1. Create the 'user' custom scope:+Any Vault auth method may be used within the OIDC flow. For simplicity, enable the+`userpass` auth method.+2. Create a user:```text-$ TOKEN_TEMPLATE=$(cat << EOF-{-"username": {{identity.entity.aliases.$MOUNT_ACCESSOR.name}},-"contact": {-"email": {{identity.entity.metadata.email}},-"phone_number": {{identity.entity.metadata.phone_number}}-},-"groups": {{identity.entity.groups.names}}-}-EOF-)-$ vault write identity/oidc/scope/user \-description="Scope for user metadata" \-template="$(echo $TOKEN_TEMPLATE | base64 -)"-Success! Data written to: identity/oidc/scope/user+$ vault write auth/userpass/users/end-user password="securepassword"+Success! Data written to: auth/userpass/users/end-user```1. Create an OIDC client:+This user will authenticate to Vault through a client application, otherwise known as+an OIDC [relying party](https://openid.net/specs/openid-connect-core-1_0.html#Terminology).+3. Create a client application:```text$ vault write identity/oidc/client/my-webapp \-redirect_uris="http://127.0.0.1:8251/callback,http://127.0.0.1:8500/ui/oidc/callback" \-assignments="my-assignment" \-key="my-key" \-id_token_ttl="30m" \-access_token_ttl="1h"+redirect_uris="https://localhost:9702/auth/oidc-callback" \+assignments="allow_all"Success! Data written to: identity/oidc/client/my-webapp```1. Create an OIDC provider:+This operation creates a client application which can be used to configure an OIDC+relying party. See the [client applications](/docs/concepts/oidc-provider#client-applications)+section for details on different client types, including `confidential` and `public` clients.```text-$ vault write identity/oidc/provider/my-provider \-allowed_client_ids="xxAQWBYzD2WXsB8GiZqwq4jsUwfG0hJV" \-scopes_supported="user"-Success! Data written to: identity/oidc/provider/my-provider-```+The `assignments` parameter limits the Vault entities and groups that are allowed to+authenticate through the client application. By default, no Vault entities are allowed.+To allow all Vault entities to authenticate, the built-in [allow_all](/docs/concepts/oidc-provider#assignments)+assignment is provided.1. Query the OIDC provider configuration:+5. Read client credentials:```text-$ curl -s http://127.0.0.1:8200/v1/identity/oidc/provider/my-provider/.well-known/openid-configuration-{-"issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/my-provider",-"jwks_uri": "http://127.0.0.1:8200/v1/identity/oidc/provider/my-provider/.well-known/keys",-"authorization_endpoint": "http://127.0.0.1:8200/ui/vault/identity/oidc/provider/my-provider/authorize",-"token_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/my-provider/token",-"userinfo_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/my-provider/userinfo",-"request_uri_parameter_supported": false,-"id_token_signing_alg_values_supported": [-"RS256",-"RS384",-"RS512",-"ES256",-"ES384",-"ES512",-"EdDSA"-],-"response_types_supported": [-"code"-],-"scopes_supported": [-"user",-"openid"-],-"subject_types_supported": [-"public"-],-"grant_types_supported": [-"authorization_code"-],-"token_endpoint_auth_methods_supported": [-"client_secret_basic"-]-}+$ vault read identity/oidc/client/my-webapp+Key Value+--- -----+access_token_ttl 24h+assignments [allow_all]+client_id GSDTnn3KaOrLpNlVGlYLS9TVsZgOTweO+client_secret hvo_secret_gBKHcTP58C4aq7FqPWsuqKgpiiegd7ahpifGae9WGkHRCwFEJTZA9KGdNVpzE0r8+client_type confidential+id_token_ttl 24h+key default+redirect_uris [https://localhost:9702/auth/oidc-callback]```The `client_id` and `client_secret` are the client application's credentials. These+values are typically required when configuring an OIDC relying party.+6. Read OIDC discovery configuration:+```text+$ curl -s http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/openid-configuration+{+"issuer": "http://127.0.0.1:8200/v1/identity/oidc/provider/default",+"jwks_uri": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/.well-known/keys",+"authorization_endpoint": "http://127.0.0.1:8200/ui/vault/identity/oidc/provider/default/authorize",+"token_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/token",+"userinfo_endpoint": "http://127.0.0.1:8200/v1/identity/oidc/provider/default/userinfo",+"request_uri_parameter_supported": false,+"id_token_signing_alg_values_supported": [+"RS256",+"RS384",+"RS512",+"ES256",+"ES384",+"ES512",+"EdDSA"+],+"response_types_supported": [+"code"+],+"scopes_supported": [+"openid"+],+"subject_types_supported": [+"public"+],+"grant_types_supported": [+"authorization_code"+],+"token_endpoint_auth_methods_supported": [+"none",+"client_secret_basic"+]+}+```+Each Vault OIDC provider publishes [discovery metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).+The `issuer` value is typically required when configuring an OIDC relying party.+## Usage+After configuring a Vault auth method and client application, the following details can+be used to configure an OIDC relying party to delegate end-user authentication to Vault.+- `client_id` - The ID of the client application+- `client_secret` - The secret of the client application+- `issuer` - The issuer of the Vault OIDC provider+A number of HashiCorp products provide OIDC authentication methods. This means that they+can leverage Vault as a source of identity using the OIDC protocol. See the following links+for details on configuring OIDC authentication for other HashiCorp products:+- [Boundary](https://learn.hashicorp.com/tutorials/boundary/oidc-auth)+- [Consul](https://www.consul.io/docs/security/acl/auth-methods/oidc)+- [Waypoint](https://www.waypointproject.io/docs/server/auth/oidc)+Otherwise, refer to the documentation of the specific OIDC relying party for usage details.+## Supported Flows+The Vault OIDC provider feature currently supports the following authentication flow:+- [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth).+## Learn+Refer to the [Vault as an OIDC Identity Provider](https://learn.hashicorp.com/tutorials/vault/oidc-identity-provider)+guide for an advanced tutorial on configuring HashiCorp [Boundary](https://www.boundaryproject.io/)+to leverage Vault as a source of identity using the OIDC protocol.+## APIThe Vault OIDC provider feature has a full HTTP API. Please see theactions-packaging-linux@v1 (#14642).github/workflows/build.yml | 2 +-1 file changed, 1 insertion(+), 1 deletion(-)
website/content/docs/release-notes/1.10.mdx+151 −0
@@ -0,0 +1,151 @@+---+layout: docs+page_title: 1.10+description: |-+This page contains release notes for Vault 1.10+---+# Vault 1.10 Release notes+**Software Release date:** Mar 23, 2022+**Summary:** Vault version 1.10 offers features and enhancements that improve the user experience while closing the loop on key issues previously encountered by our customers. We are providing a summary of these improvements in these release notes.+We encourage you to upgrade to the latest release to take advantage of the new benefits that we are providing. Additionally, with this latest release, we offer solutions to critical feature gaps that have been identified previously. For further information on product improvements, including a comprehensive list of bug fixes, please refer to the [Changelog](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md) within the Vault 1.10 release.+Some of these enhancements and changes in this release include:+- Ability to view client counts per auth and changes to clients over months, therefore, providing more granular visibility into clients.+- Extended the `sys/remount` API endpoint to support moving secrets engines and auth method mounts from one location to another, within a namespace or across namespaces.+- Improved security posture that includes MFA on login for Vault OSS customers.+- Ability to implicitely achieve consistency via tokens.+- Support of PKCE on Vault’s OIDC auth method with Telemetry support for the Vault Agent.+- Improvement of key areas and parity to support using Terraform Provider with Vault.+## New Features+This section describes the new features introduced as part of Vault 1.10+### Multi-Factor Authentication (MFA) for Vault OSS+Vault has had support for the [Step-up Enterprise MFA](docs/enterprise/mfa) as part of its Enterprise edition. The Step-up Enterprise MFA allows having an MFA on login, or for step-up access to sensitive resources in Vault.+With Vault 1.10, MFA as part of [login](/docs/auth.login-mfa) is now supported for Vault OSS. This demonstrates HashiCorp’s thought leadership in security and its continued endeavor to enable all Vault users to employ strong security policies with Vault.+~> **Note:** The Legacy MFA in Vault OSS is a [deprecated](https://www.vaultproject.io/docs/deprecation) feature and will be removed in Vault 1.11.+Refer to the [Login MFA FAQ](/auth/login-mfa/faq) to understand the various MFA workflows that are supported in Vault 1.10.+### Vault OIDC provider with PKCE support+Vault’s support to act as an OIDC provider is now generally available. Furthermore, Vault’s OIDC provider functionality can now support PKCE for authorization code flow as well. Thanks to all the excellent community feedback received, we have simplified the user experience around configuration of OIDC provider functionality.+### Caching support for Vault Lambda Extension+With 0.6.0, Vault Lambda Extension supports [caching](https://github.com/hashicorp/vault-lambda-extension#caching) in the local proxy server to avoid proxying every request to enable setting expiry time and invalidate cache, as needed.+### Terraform Provider for Vault+We have introduced three new resources to enable configuration of the [KMIP secrets engine](https://registry.terraform.io/providers/hashicorp/vault/latest/docs/resources/kmip_secret_backend) using the Terraform Provider for Vault. In addition, frequent releases on the Terraform Provider for Vault have been incorporating the ability to configure newer resources and data sources. Please read the [documentation](https://registry.terraform.io/providers/hashicorp/vault/latest/docs) for more details.+### KV Secrets Engine v2 patch operations+We now support an additional method for managing [KV v2 secrets](/api-docs/secret/kv/kv-v2) to maintain least privilege security in certain types of automated environments. This feature creates a new PATCH capability that enables partial updates to KV v2 secrets without requiring the READ privilege to the entire endpoint for an entity.+### DB2 Dynamic Secrets support+Vault operators can leverage the openldap secrets engine to manage credentials for IBM DB2 and the LDAP security plugin for Db2. This allows Db2 to offload authentication and authorization to the LDAP security plugin and allows Vault to manage static credentials or even generate dynamic users. For more details, refer to the For more details, refer to the [IBM Db2 Credentials Management](https://learn.hashicorp.com/tutorials/vault/ibm-db2-openldap) tutorial.+### Temporal Transit Key rotation+Proper key management includes occasionally rotating encryption keys to reduce the risks of a nonce reuse and opportunities for keys to be compromised. Previously, there was no automated way to rotate keys that is native to Vault. Now, we have provided a new configuration element on transit keys and tokenization transform configurations where a time interval triggers the keys to automatically rotate after the interval has lapsed.+### PKI HSM Forwarding+To address security and compliance needs, customers may require that keys be either created or stored within Hardware Security Models (HSMs). Vault 1.10 introduces an accommodation for this requirement with regards to the PKI Secrets Engine. We now support offloading selected PKI operations to HSMs, in particular allowing customers to both generate new PKI key pairs and sign/verify some certificate workflows. All of these operations are conducted in a way that never allows the private key material to leave the secure confines of the HSM itself.+### AWS and AKV KMS Forwarding+The work done above to support HSM-backed PKI operations inspired us to consider what other key possession paradigms we could support. This led us to extend the implementation to support Cloud Key Management Systems in addition to HSMs. In Vault 1.10, users may generate new PKI pairs and perform sign/verify certificate workflows, all with those keys never leaving the cloud KMS itself. Vault 1.10 provides support for AWS Key Management Service and Azure Key Vault Key Management Service.+### Server Side Consisten Tokens+Vault’s [eventual consistency](/docs/enterprise/consistency) model precludes read-after-write guarantees when clients interact with performance standbys or performance replication clusters. The [Client Controlled Consistency](/docs/enterprise/consistency#vault-1-7-mitigations) mitigations supported with Vault 1.7 provide ways to achieve consistency through client modifications or by using the agent for proxied requests, which is not possible in all cases. The Server Side Consistent Tokens feature provides an implicit way to achieve consistency by embedding the minimum Write-Ahead-Log state information in the Service tokens returned from logins or token-create requests. This feature introduces changes in the token format and the new tokesn will be the default tokens starting in Vault 1.10. Vault 1.10 is backwards compatible with old tokens.+See [Replication](/docs/configuration/replication), [Vault Eventual Consistency](/docs/enterprise/consistency), [Upgrade to 1.10](/docs/upgrading/upgrade-to-1.10.x) and [Service Side Consistent Token FAQ](/docs/faq/ssct) to understand the various consistency options available with Vault 1.10 and the considerations to be aware of prior to selecting an option for your use case.+## Vault Agent Features+### Support for Telemetry+Starting with Vault 1.10, the Vault Agent supports a new metrics endpoint and [Telemetry](/docs/agent#telemetry-stanza) metrics around run time, authentication success, authentication failures, cache hits, cache misses, proxy succes, and proxy client errors. This Vault Agent Telemetry should greatly help with the retrieval of key operational insights for Vault Agent deployments.+### User-assigned managed identities for auto auth in Azure+With this [enhancement](/docs/agent/autoauth/methods/azure), users can specify user-assigned managed identities via the `object_id` and `client_id` when configuring Vault agent auto-auth for Azure. This enables users that have more than one user-assigned managed identity associated with their VM to specify which one they'd like to use when authenticating via the Vault's Azure auth method. Note that providing these parameters is an "exclusive or" operation.+### Quit API endpoint with config+Previously, for instances where the Agent is a sidecar in a Kubernetes job and the job hangs, you must either use `shareProcessNamespace: true` for the container so that the process kill signals can be sent, or avoid the sidecar container entirely and solely rely on an init container. With this [enhancement](/docs/agent#quit), we have added support for a Quit API endpoint to automatically shut down the Vault Agent, therefore eliminating the need to perform the workarounds.+## Other Features and Enhancements+This section describes other features and enhancements introduced as part of the Vault 1.10 release.+### Client Count improvements+We have introduced auth mount-based attribution of clients to help better understand where clients are being used within a cluster. This is available via UI and API. This is an enhancement on top of the namespace attribution capability we introduced in Vault 1.9.+We have also introduced the ability to view changes to clients month over month via the client count API, and made other UI enhancements. Refer to [What is a Client?](/docs/concepts/client-count) and [Client Count FAQ](/docs/concepts/client-count/faq) for more details.+### Mount Migration+We have made improvements to the `sys/remount` API endpoint to simplify the complexities of moving data, such as secret engine and authentication method configuration from one mount to another, within a namespace or across namespaces. This can help with restructuring namespaces and mounts for various reasons, including migrating mounts from root to other namespaces when transitioning to using namespaces for the first time. For step-by-step instructions, refer to the [Mount Move](https://learn.hashicorp.com/tutorials/vault/mount-move) tutorial.+### Scaling External Database plugins+Database plugins can now implement [plugin multiplexing](/docs/internals/plugins#plugin-development) which allows a single plugin process to be used for multiple database connections. Database plugin multiplexing will be enabled on the Oracle Database plugin starting in v0.6.0. We will extend this functionality to additional database plugins in subsequent releases.+Any external database plugins that want to adopt multiplexing support will have to update their main.go call from [dbplugin.Serve()](https://github.com/hashicorp/vault/blob/sdk/v0.4.1/sdk/database/dbplugin/v5/plugin_server.go#L13) to [dbplugin.ServeMultiplex()](https://github.com/hashicorp/vault/blob/sdk/v0.4.1/sdk/database/dbplugin/v5/plugin_server.go#L42). Multiplexable database plugins are compatible with older versions of Vault down to Vault 1.6. Refer to this [Oracle Database PR](https://github.com/hashicorp/vault-plugin-database-oracle/pull/74) as an example of the upgrade process.+### Consul Secrets Engine enhancements+Consul has supported [namespace](https://www.consul.io/docs/enterprise/namespaces), [admin partitions](https://www.consul.io/docs/enterprise/admin-partitions) and [ACL roles](https://www.consul.io/commands/acl/role) for some time now. In this release we have added enhancements to the Consul Secrets engine to support [namespace]() awareness and add admin partition and role support for Consul ACL tokens. This significantly simplifies the integrations for customers who want to achieve a zero trust security posture with both Vault and Consul.+### Using sessionStorage instead of localStorage for the Vault UI+Prior to Vault 1.10, the Vault UI used localStorage to store authentication information. The data in localStorage was persisted in browsers and removed only on demand. Now, we have switched the Vault UI to use sessionStorage instead, which ensures that the authentication information is stored in the current browser tab alone, thereby improving security.+### Advanced I/O Handling for Transform FPE+The Transform Secrets Engine allows users to securely encrypt data while providing control over the output format. In Vault 1.9, we introduced [additional format fields](/docs/release-notes/1.9.0#advanced-i-o-handling-for-tranform-fpe-adp-transform) on the templates used for this workflow. In Vault 1.10, we have now added those two new fields, `encode_format` and `decode_format`, to the Create Template page on the UI under Advanced Templating.+## Breaking changes+The following section details breaking changes introduced in Vault 1.10.+### LDAP auth method entity alias mapping+In Vault 1.9, we added support to provide custom user filters through the [userfilter](/api-docs/auth/ldap#userfilter) parameter. This support changed the way that entity alias was mapped to an entity. Prior to Vault 1.9, alias names were always based on the [login username](/api-docs/auth/ldap#username-3) (which in turn is based on the value of the [userattr](/api-docs/auth/ldap#userattr)). In Vault 1.9, alias names no longer mapped to the login username. Instead, the mapping depends on other config values as well, such as [updomain](/api-docs/auth/ldap#upndomain), [binddn](/api-docs/auth/ldap#binddn), [discoverydn](/api-docs/auth/ldap#discoverdn), and [userattr](/api-docs/auth/ldap#userattr).+With Vault 1.10, we re-introduced the option to force the alias name to map to the login username with the optional parameter username_as_alias. Users that have the LDAP auth method enabled prior to Vault 1.9 may want to consider setting this to true to revert back to the old behavior. Otherwise, depending on the other aforementioned config values, logins may generate a new and different entity for an existing user with a previous entity associated in Vault. This in turn affects client counts since there may be more than one entity tied to this user. The username_as_alias flag was also made available in subsequent Vault 1.8.x and Vault 1.9.x releases to allow for this to be set prior to a Vault 1.10 upgrade.+## Known issues+### Single Vault follower restart causes election even with established quorum+We now support Server Side Consistent Tokens (See [Replication](/docs/configuration/replication), [Vault Eventual Consistency](/docs/enterprise/consistency), and [Upgrade to 1.10](/docs/upgrading/upgrade-to-1.10.x).), which introduces a new token format that can only be used on nodes of 1.10 or higher version. This new format is enabled by default upon upgrading to the new version. Old format tokens can be read by Vault 1.10, but the new format Vault 1.10 tokens cannot be read by older Vault versions.+For more details, see the [Server Side Consistent Tokens FAQ](/docs/faq/ssct).+Since service tokens are always created on the leader, as long as the leader is not upgraded before performance standbys, service tokens will be of the old format and still be usable during the upgrade process. However, the usual upgrade process we recommend can't be relied upon to always upgrade the leader last. Due to this known [issue](https://github.com/hashicorp/vault/issues/14153), a Vault cluster using Integrated Storage may result in a leader not being upgraded last, and this can trigger a re-election. This re-election can cause the upgraded node to become the leader, resulting in the newly created tokens on the leader to be unusable on nodes that have not yet been upgraded. Note that this issue does not impact Vault OSS users.+We will have a fix for this issue in Vault 1.10.1. Until this issue is fixed, you may be at risk of having performance standbys unable to service requests until all nodes are upgraded. We recommended that you plan for a maintenance window to upgrade.+### Limited policy shows unhelpful message in UI after mounting a secret engine+When a user has a policy that allows creating a secret engine but not reading it, after successful creation, the user sees a message `n is undefined` instead of a permissions error. We will have a fix for this issue in an upcoming minor release.+## Feature Deprecations and EOL+Please refer to the [Deprecation Plans and Notice](/docs/deprecation) page for up-to-date information on feature deprecations and plans. An [Feature Deprecation FAQ](/deprecation/faq) page is also available to address questions concerning decisions made about Vault feature deprecations.
website/content/docs/concepts/oidc-provider.mdx+73 −21
@@ -7,24 +7,25 @@ description: >-# OIDC Provider~> **Note:** This feature is currently a ***Tech Preview*** and not recommended for deployment in production.-This document describes how Vault can be an **OpenID Connect (OIDC) identity provider** by enabling applications to leverage Vault as a source of identity using the OIDC protocol.-This feature allows clients speaking the OIDC protocol to take advantage of Vault's various authentication methods and source of identity. Clients can configure their authentication logic to talk to Vault. Once enabled, Vault will act as the bridge to identity providers via its existing authentication methods. Clients will also obtain identity information for their end-users by leveraging custom templating of Vault identity information.-Vault as an OIDC provider allows mutual Vault and Boundary customers to leverage Vault's identity system to delegate authentication and authorization to Vault. Vault, therefore, acts as an identity provider for Boundary. Other HashiCorp products such as Consul can also leverage Vault's identity system and provide delegated authentication and authorization to its users. Having Vault as an OIDC provider allows a single sign-on experience to their end-users for organizations that want to leverage Vault as an identity provider.+This document provides conceptual information about the Vault **OpenID Connect (OIDC) identity+provider** feature. This feature enables client applications that speak the OIDC protocol to+leverage Vault's source of [identity](/docs/concepts/identity) and wide range of [authentication methods](/docs/auth)+when authenticating end-users. For more information about the usage of Vault's OIDC provider,+refer to the [OIDC identity provider](/docs/secrets/identity/oidc-provider) documentation.## Configuration OptionsThe next few sections of the document provide implementation details for each resource that permits Vault configuration as an OIDC identity provider.### Providers+### OIDC Providers+Each Vault namespace will contain a built-in provider resource named `default`. The `default`+provider will allow all client applications within the namespace to use it for OIDC flows.+The `default` provider can be modified but not deleted.A Vault namespace may contain several provider resources. Each configured provider will publish the APIs listed within the OIDC flow. The APIs will be served via backend path-based routing on Vault's listen [address](/docs/configuration/listener/tcp#address).+Additionally, a Vault namespace may contain several provider resources. Each configured provider will publish the APIs listed within the [OIDC flow](/docs/concepts/oidc-provider#oidc-flow) section. The APIs will be served via backend path-based routing on Vault's listen [address](/docs/configuration/listener/tcp#address).A provider must have the following configuration parameters:+A provider has the following configuration parameters:* **Issuer URL**: used in the `iss` claim of ID tokens* **Allowed client IDs**: limits which clients can access the provider@@ -32,7 +33,9 @@ A provider must have the following configuration parameters:The issuer URL parameter is necessary for the validation of ID tokens by clients. If an URL parameter is not provided explicitly, it will default to a URL with Vault's [api_addr](/docs/configuration#api_addr) as the `scheme://host:port` component and `/v1/:namespace/identity/oidc/provider/:name` as the path component. This means tokens issued by a provider in a specified Vault cluster must be validated within that same cluster. If the issuer URL is provided explicitly, it must point to a Vault instance that is network-reachable by clients for ID token validation.The allowed client IDs parameter utilizes the list of client IDs that have been generated by Vault as a part of client registration. By default, all clients will be *disallowed*. Providing an asterisk(*) as the parameter value will allow all clients to use the provider. The scopes parameter employs a list of references to named scope resources. The values provided are discoverable by the `scopes_supported` key in the OIDC discovery document of the provider. By default, a provider will have the `openid` scope available. See the scopes section below for more details on the `openid` scope.+The allowed client IDs parameter utilizes the list of client IDs that have been generated by Vault as a part of client registration. By default, all clients will be *disallowed*. Providing an asterisk(*) as the parameter value will allow all clients to use the provider.+The scopes parameter employs a list of references to named scope resources. The values provided are discoverable by the `scopes_supported` key in the OIDC discovery document of the provider. By default, a provider will have the `openid` scope available. See the scopes section below for more details on the `openid` scope.### Scopes@@ -85,7 +88,7 @@ Several named scopes can be made available on an individual provider. Note thatThe `openid` scope is a unique case scope that may not be modified or deleted. The scope will exist in Vault and supported by each provider by default. The scope represents the minimum set of claims required by the OIDC specification for inclusion in ID tokens. As such, templates may not contain top-level keys that overwrite the claims populated by the openid scope.The following defines the claims key and value mapping for the openid scope:+The following defines the claims key and value mapping for the `openid` scope:* `iss`- configured issuer of the provider* `sub`- unique entity ID of the Vault user@@ -93,31 +96,76 @@ The following defines the claims key and value mapping for the openid scope:* `iat`- time of token issue* `exp`- time of token issue + ID token TTL### Client registration+### Client ApplicationsA client resource allows the relying party to [dynamically register](https://openid.net/specs/openid-connect-registration-1_0.html) by providing metadata about itself to Vault.+A client resource represents an application that wants to delegate end-user authentication+to Vault using the OIDC protocol. The information provided by a client resource can be used+to configure an OIDC [relying party](https://openid.net/specs/openid-connect-core-1_0.html#Terminology).The client must have the following configuration parameters:+A client has the following configuration parameters:* **Redirect URIs**: limits the valid redirect URIs in an authentication request-* **Assignments**: determines who can authenticate with the client+* **Assignments**: determine who can authenticate with the client* **Key**: used to sign the ID tokens* **ID token TTL**: specifies the time-to-live for ID tokens-* **Access token TTL**: establishes the time-to-live for access tokens+* **Access token TTL**: specifies the time-to-live for access tokens+* **Client type**: determines the client's ability to maintain confidentiality of credentialsA `client_id` and `client_secret` are generated and returned after a successful client registration. Their values are strings using the base62 character set. The `client_id` will have 32 characters, and the `client_secret` will have a prefix of `hvo_secret`. The `client_id` uniquely identifies the client. The `client_secret` will be used to authenticate to the token endpoint as described in [client authentication](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).+The `key` parameter is optional. The key will be used to sign ID tokens for the client.+It cannot be modified after creation. If not supplied, defaults to the built-in+[default key](/docs/concepts/oidc-provider#keys).The `key` parameter is required. The user must create a `key` as a required parameter of the client configuration.+A `client_id` is generated and returned after a successful client registration. The+`client_id` uniquely identifies the client. Its value will be a string with 32 random+characters from the base62 character set.~> **Note**: At least one of the redirect URIs of a client must exactly match the `redirect_uri` parameter used in an authentication request initiated by the client.#### Client Types+A client resource has a `client_type` parameter which specifies the OAuth 2.0+[client type](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1) based on+its ability to maintain confidentiality of credentials. The following sections detail+the differences between confidential and public clients in Vault.+##### Confidential+Confidential clients are capable of maintaining the confidentiality of their credentials.+Confidential clients have a `client_secret`. The `client_secret` will have a prefix of+`hvo_secret` followed by 64 random characters in the base62 character set.+Confidential clients may use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))+during the authorization code flow.+Confidential clients must authenticate to the token endpoint using the+`client_secret_basic` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).+##### Public+Public clients are not capable of maintaining the confidentiality of their credentials.+As such, public clients do not have a `client_secret`.+Public clients must use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))+during the authorization code flow.+Public clients use the `none` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).+### AssignmentsAssignment resources are referenced by clients via the `assignments` parameter. This parameter limits the set of Vault users allowed to authenticate. The assignments of an associated client are validated during the authentication request, ensuring that the Vault identity associated with the request is a member of the assignment's entities or groups.Each Vault namespace will contain a built-in assignment resource named `allow_all`. The+`allow_all` assignment allows all Vault entities to authenticate through a client. The+`allow_all` assignment cannot be modified or deleted.+### KeysKey resources are referenced by clients via the key parameter. This parameter specifies the key that will be used to sign ID tokens for the client. See existing [documentation](/api-docs/secret/identity/tokens#create-a-named-key) for details on keyring management, supported signing algorithms, rotation periods, and verification TTLs. Currently, a key referenced by a client cannot be changed.+Key resources are referenced by clients via the `key` parameter. This parameter specifies the key that will be used to sign ID tokens for the client. See existing [documentation](/api-docs/secret/identity/tokens#create-a-named-key) for details on keyring management, supported signing algorithms, rotation periods, and verification TTLs. Currently, a key referenced by a client cannot be changed.+Each Vault namespace will contain a built-in key resource named `default`. Clients that don't+specify the `key` parameter at creation time will use the `default` key. The `default` key+will use the `RS256` signing algorithm, allow all client IDs, and have rotation and verification+TTLs of `24h`. The `default` key can be modified but not deleted.## OIDC flow@@ -127,6 +175,10 @@ The following sections provide implementation details for the OIDC compliant APIVault OIDC providers enable registered clients to authenticate and obtain identity information (or "claims") for their end-users. They do this by providing the APIs and behavior required to satisfy the OIDC specification for the [authorization code flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth). All clients are treated as first-party. This means that end-users will not be required to provide consent to the provider as detailed in section [3.1.2.4](https://openid.net/specs/openid-connect-core-1_0.html#Consent) of the OIDC specification. The provider will release information to clients as long as the end-user has ACL access to the provider and their identity has been authorized via an assignment.Vault OIDC providers implement Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))+to mitigate authorization code interception attacks. PKCE is required for `public` client types+and optional for `confidential` client types.+### OpenID configurationEach provider offers an unauthenticated endpoint that facilitates OIDC Discovery. All required metadata listed in [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata) is included in the discovery document. Additionally, the recommended `userinfo_endpoint` and `scopes_supported` metadata are included.
website/content/docs/platform/aws/lambda-extension-cache.mdx+304 −0
@@ -0,0 +1,304 @@+---+layout: docs+page_title: Vault Lambda Extension Caching+description: >-+Supports caching to the local proxy server for the Vault Lambda Extension.+---+# Vault Lambda Extension+AWS Lambda lets you run code without provisioning and managing servers.+You can use the [quick-start](https://github.com/hashicorp/vault-lambda-extension/tree/0af1a648bfa4b9f37a04dd4311d8355f5c3902c3/quick-start) directory which has an end-to-end example if you would like to try out the extension from scratch.+~> **Note**: If you decide to create one from scratch, be aware that this will create real infrastructure with an associated cost as per AWS' pricing.+## Usage+To use the extension, include the following ARN as a layer in your Lambda function:+```text+arn:aws:lambda:us-east-1:634166935893:layer:vault-lambda-extension:11+```+Where region may be any of `af-south-1`, `ap-east-1`, `ap-northeast-1`,+`ap-northeast-2`, `ap-northeast-3`, `ap-south-1`, `ap-southeast-1`,+`ap-southeast-2`, `ca-central-1`, `eu-central-1`, `eu-north-1`, `eu-south-1`,+`eu-west-1`, `eu-west-2`, `eu-west-3`, `me-south-1`, `sa-east-1`, `us-east-1`,+`us-east-2`, `us-west-1`, `us-west-2`.+The extension authenticates with Vault using [AWS IAM auth](/docs/auth/aws),+and all configuration is supplied via environment variables. There are two methods+to read secrets, which can both be used side-by-side:+- **Recommended**: Make unauthenticated requests to the extension's local proxy+server at `http://127.0.0.1:8200`, which will add an authentication header and+proxy to the configured `VAULT_ADDR`. Responses from Vault are returned without+modification.+- Configure environment variables such as `VAULT_SECRET_PATH` for the extension+to read a secret and write it to disk.+### Adding the extension to your existing Lambda and Vault infrastructure+#### Requirements+- ARN of the role your Lambda runs as+- An instance of Vault accessible from AWS Lambda+- An authenticated `vault` client+- A secret in Vault that you want your Lambda to access, and a policy giving read access to it+- Your Lambda function must use one of the [supported runtimes][lambda-supported-runtimes] for extensions+#### Step 1. Configure Vault+Enable the aws auth method.+```shell-session+$ vault auth enable aws+```+Configure the AWS client to use the default options.+```shell-session+$ vault write -force auth/aws/config/client+```+Create a role prefixed with the AWS environment name.+```shell-session+$ vault write auth/aws/role/vault-lambda-role \+auth_type=iam \+bound_iam_principal_arn="${YOUR_ARN}" \+policies="${YOUR_POLICY}" \+ttl=1h+```+#### Step 2. Option a) Install the extension for Lambda functions packaged in zip archives+If you deploy your Lambda function as a zip file, you can add the extension+to your Lambda layers using the console or [cli](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html#configuration-layers-using):+```text+arn:aws:lambda:<your-region>:634166935893:layer:vault-lambda-extension:11+```+#### Step 2. Option b) Install the extension for Lambda functions packaged in container images+Alternatively, if you deploy your Lambda function as a container image, simply+place the built binary in the `/opt/extensions` directory of your image.+Fetch the binary from+[releases.hashicorp.com](https://releases.hashicorp.com/vault-lambda-extension/).+The following command requires cURL.+```shell-session+$ curl --silent https://releases.hashicorp.com/vault-lambda-extension/0.5.0/vault-lambda-extension_0.5.0_linux_amd64.zip \+--output vault-lambda-extension.zip+```+Unzip the donwloaded binary.+```shell-session+$ unzip vault-lambda-extension.zip+```+Optionally, you can verify the integrity of the downloaded zip using the release+archive checksum verification instructions+[here](https://www.hashicorp.com/security).+Or to build the binary from source. This requires Golang installed. Run from the root of this repository.+```shell-session+$ GOOS=linux GOARCH=amd64 go build -o vault-lambda-extension main.go+```+#### Step 3. Configure vault-lambda-extension+Configure the extension using [Lambda environment+variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html):+Set the Vault API address.+```shell-session+$ VAULT_ADDR=http://vault.example.com:8200+```+Set the AWS IAM auth mount point (i.e. the path segment after `auth/` from above).+```shell-session+$ VAULT_AUTH_PROVIDER=aws+```+Set the Vault role to authenticate as. Must be configured for the ARN of your+Lambda's role.+```shell-session+$ VAULT_AUTH_ROLE=vault-lambda-role+```+The path to a secret in Vault. Can be static or dynamic. Unless+VAULT_SECRET_FILE is specified, JSON response will be written to+`/tmp/vault/secret.json`.+```shell-session+$ VAULT_SECRET_PATH=secret/lambda-app/token+```+If everything is correctly set up, your Lambda function can then read secret+material from `/tmp/vault/secret.json`. The exact contents of the JSON object+will depend on the secret read, but its schema is the [Secret struct](https://github.com/hashicorp/vault/blob/api/v1.0.4/api/secret.go#L15)+from the Vault API module.+Alternatively, you can send normal Vault API requests over HTTP to the local+proxy at `http://127.0.0.1:8200`, and the extension will add authentication+before forwarding the request. Vault responses will be returned unmodified.+Although local communication is over plain HTTP, the proxy server will use TLS+to communicate with Vault if configured to do so as detailed below.+## Configuration+The extension is configured via [Lambda environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html).+Most of the [Vault CLI client's environment variables](/docs/commands#environment-variables) are available,+as well as some additional variables to configure auth, which secret(s) to read and+where to write secrets.+| Environment variable | Description | Required | Example value |+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | --------------------------- |+| `VLE_VAULT_ADDR` | Vault address to connect to. Takes precedence over `VAULT_ADDR` so that clients of the proxy server can be configured using the standard `VAULT_ADDR` | No | `https://x.x.x.x:8200` |+| `VAULT_ADDR` | Vault address to connect to if `VLE_VAULT_ADDR` is not set. Required if `VLE_VAULT_ADDR` is not set | No | `https://x.x.x.x:8200` |+| `VAULT_AUTH_PROVIDER` | Name of the configured AWS IAM auth route on Vault | Yes | `aws` |+| `VAULT_AUTH_ROLE` | Vault role to authenticate as | Yes | `lambda-app` |+| `VAULT_IAM_SERVER_ID` | Value to pass to the Vault server via the [`X-Vault-AWS-IAM-Server-ID` HTTP Header for AWS Authentication](/api-docs/auth/aws#iam_server_id_header_value) | No | `vault.example.com` |+| `VAULT_SECRET_PATH` | Secret path to read, written to `/tmp/vault/secret.json` unless `VAULT_SECRET_FILE` is specified | No | `database/creds/lambda-app` |+| `VAULT_SECRET_FILE` | Path to write the JSON response for `VAULT_SECRET_PATH` | No | `/tmp/db.json` |+| `VAULT_SECRET_PATH_FOO` | Additional secret path to read, where FOO can be any name, as long as a matching `VAULT_SECRET_FILE_FOO` is specified | No | `secret/lambda-app/token` |+| `VAULT_SECRET_FILE_FOO` | Must exist for any correspondingly named `VAULT_SECRET_PATH_FOO`. Name has no further effect beyond matching to the correct path variable | No | `/tmp/token` |+| `VAULT_TOKEN_EXPIRY_GRACE_PERIOD` | Period at the end of the proxy server's auth token TTL where it will consider the token expired and attempt to re-authenticate to Vault. Must have a unit and be parseable by `time.Duration`. Defaults to 10s. | No | `1m` |+| `VAULT_STS_ENDPOINT_REGION` | The region of the STS regional endpoint to authenticate with. If the AWS IAM auth mount specified uses a regional STS endpoint, then this needs to match the region of that endpoint. Defaults to using the global endpoint, or the region the Lambda resides in if `AWS_STS_REGIONAL_ENDPOINTS` is set to `regional` | No | `eu-west-1` |+The remaining environment variables are not required, and function exactly as+described in the [Vault Commands (CLI)](/docs/commands#environment-variables) documentation. However,+note that `VAULT_CLIENT_TIMEOUT` cannot extend the timeout beyond the 10s+initialization timeout imposed by the Extensions API when writing files to disk.+| Environment variable | Description | Required | Example value |+| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------- |+| `VAULT_CACERT` | Path to a PEM-encoded CA certificate _file_ on the local disk | No | `/tmp/ca.crt` |+| `VAULT_CAPATH` | Path to a _directory_ of PEM-encoded CA certificate files on the local disk | No | `/tmp/certs` |+| `VAULT_CLIENT_CERT` | Path to a PEM-encoded client certificate on the local disk | No | `/tmp/client.crt` |+| `VAULT_CLIENT_KEY` | Path to an unencrypted, PEM-encoded private key on disk which corresponds to the matching client certificate | No | `/tmp/client.key` |+| `VAULT_CLIENT_TIMEOUT` | Timeout for Vault requests. Default value is 60s. Ignored by proxy server. **Any value over 10s will exceed the Extensions API timeout and therefore have no effect** | No | `5s` |+| `VAULT_MAX_RETRIES` | Maximum number of retries on `5xx` error codes. Defaults to 2. Ignored by proxy server | No | `2` |+| `VAULT_SKIP_VERIFY` | Do not verify Vault's presented certificate before communicating with it. Setting this variable is not recommended and voids Vault's [security model](/docs/internals/security) | No | `true` |+| `VAULT_TLS_SERVER_NAME` | Name to use as the SNI host when connecting via TLS | No | `vault.example.com` |+| `VAULT_RATE_LIMIT` | Only applies to a single invocation of the extension. See [Vault Commands (CLI)](/docs/commands#environment-variables) documentation for details. Ignored by proxy server | No | `10` |+| `VAULT_NAMESPACE` | The namespace to use for pre-configured secrets. Ignored by proxy server | No | `education` |+| `VAULT_DEFAULT_CACHE_TTL` | The time to live configuration (aka, TTL) of the cache used by proxy server. Must have a unit and be parsable as a time.Duration. Required for caching to be enabled. | No | `15m` |+| `VAULT_DEFAULT_CACHE_ENABLED` | Enable caching for all requests, without needing to set the X-Vault-Cache-Control header for each request. Must be set to a boolean value. | No | `true` |+### AWS STS client configuration+In addition to Vault configuration, you can configure certain aspects of the STS+client the extension uses through the usual AWS environment variables. For example,+if your Vault instance's IAM auth is configured to use regional STS endpoints:+```shell-session+$ vault write auth/aws/config/client \+sts_endpoint="https://sts.eu-west-1.amazonaws.com" \+sts_region="eu-west-1"+```+Then you may need to configure the extension's STS client to also use the regional+STS endpoint by setting `AWS_STS_REGIONAL_ENDPOINTS=regional`, because both the AWS Golang+SDK and Vault IAM auth method default to using the global endpoint in many regions.+See documentation on [`sts_regional_endpoints`](https://docs.aws.amazon.com/credref/latest/refdocs/setting-global-sts_regional_endpoints.html) for more information.+### Caching+Caching can be configured for the extension's local proxy server so that it does+not forward every HTTP request to Vault. The main consideration behind caching+design is to make caching an explicit opt-in at the request level, so that it is+only enabled for scenarios where caching makes sense without negative impact in+others. To turn on caching, set the environment variable+`VAULT_DEFAULT_CACHE_TTL` to a valid value that is parsable as a time.Duration+in Go, for example, "15m", "1h", "2m3s" or "1h2m3s", depending on application+needs. An invalid or negative value will be treated the same as a missing value,+in which case, caching will not be set up and enabled.+Then requests with HTTP method of "GET", and the HTTP header+`X-Vault-Cache-Control: cache` will be returned directly from the cache if+there's a cache hit. On a cache miss the request will be forwarded to Vault and+the response returned and cached. If the header is set to+`X-Vault-Cache-Control: recache`, the cache lookup will be skipped, and the+request will be forwarded to Vault and the response returned and cached.+Currently, the cache key is a hash of the request URL path, headers, body, and+token.+Caching may also be enabled for all requests by setting the environment variable+`VAULT_DEFAULT_CACHE_ENABLE` to `true`. Then all requests will be fetched and/or+cached as though the header `X-Vault-Cache-Control: cache` was present. Setting+the header to `nocache` on a request will opt-out of caching entirely in this+configuration. Setting the header to `recache` will skip the cache lookup and+return and cache the response from Vault as described previously.+## Limitations+Secrets written to disk or returned from the proxy server will not be automatically+refreshed when they expire. This is particularly important if you configure the+extension to write secrets to disk, because the extension will only write to disk+once per execution environment, rather than once per function invocation. If you+use [provisioned concurrency](https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html#configuration-concurrency-provisioned) or if your Lambda+is invoked often enough that execution contexts live beyond the lifetime of the+secret, then secrets on disk are likely to become invalid.+In line with [Lambda best practices](https://docs.aws.amazon.com/lambda/latest/dg/best-practices.html), we recommend avoiding+writing secrets to disk where possible, and exclusively consuming secrets via+the proxy server. However, the proxy server will still not perform any additional+processing with returned secrets such as automatic lease renewal. The proxy server's+own Vault auth token is the only thing that gets automatically refreshed. It will+synchronously refresh its own token before proxying requests if the token is+expired (including a grace window), and it will attempt to renew its token if the+token is nearly expired but renewable.+## Performance impact+AWS Lambda pricing is based on [number of invocations, time of execution and memory+used](https://aws.amazon.com/lambda/pricing/). The following table details some approximate performance+related statistics to help assess the cost impact of this extension. Note that AWS+Lambda allocates [CPU power in proportion to memory](https://docs.aws.amazon.com/lambda/latest/dg/configuration-memory.html) so results+will vary widely. These benchmarks were run with the minimum 128MB of memory allocated+so aim to give an approximate baseline.+| Metric | Value | Description | Derivation |+| -------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |+| Layer size | 8.5MB | The size of the unpacked extension binary | `ls -la` |+| Init latency | 8.5ms (standard deviation 2.4ms) + one network round trip to authenticate to Vault | Extension initialization time in a new execution environment. Authentication round trip time will be highly deployment-dependent | Instrumented in code |+| Invoke latency | <1ms | The base processing time for each function invocation, assuming no calls to the proxy server | Instrumented in code |+| Memory impact | 12MB | The marginal impact on "Max Memory Used" when running the extension | As reported by Lambda when running Hello World function with and without extension |+## Uploading to your own AWS account and region+If you would like to upload the extension as a Lambda layer in your own AWS+account and region, you can do the following:+```shell-session+$ curl --silent https://releases.hashicorp.com/vault-lambda-extension/0.5.0/vault-lambda-extension_0.5.0_linux_amd64.zip \+--output vault-lambda-extension.zip+```+Set your target AWS region.+```shell-session+$ export REGION="YOUR REGION HERE"+```+Upload the extension as a Lambda layer.+```shell-session+$ aws lambda publish-layer-version \+--layer-name vault-lambda-extension \+--zip-file "fileb://vault-lambda-extension.zip" \+--region "${REGION}"+```+## Learn+For step-by-step instructions, refer to the [Vault AWS Lambda Extension](https://learn.hashicorp.com/tutorials/vault/aws-lambda) tutorial for details on how to create an AWS Lambda function and use the Vault Lambda Extension to authenticate with Vault.
website/content/api-docs/secret/identity/oidc-provider.mdx+60 −16
@@ -21,7 +21,7 @@ This endpoint creates or updates a Provider.Vault's `api_addr` as the `scheme://host:port` component and `/v1/:namespace/identity/oidc/provider/:name` as the pathcomponent. If provided explicitly, it must point to a Vault instance that is network reachable by clients for ID token validation.- `allowed_client_ids` `([]string: <optional>)` – The client IDs that are permitted to use the provider. If empty, no clients are allowed. If "*", all clients are allowed.+- `allowed_client_ids` `([]string: <optional>)` – The client IDs that are permitted to use the provider. If empty, no clients are allowed. If `"*"` provided, all clients are allowed.- `scopes_supported` `([]string: <optional>)` – The scopes available for requesting on the provider.@@ -138,7 +138,8 @@ This endpoint creates or updates a scope.- `name` `(string: <required>)` – The name of the scope. This parameter is specified as part of the URL. The `openid` scope name is reserved.- `template` `(string: <optional>)` - The template string for the scope. This may be provided as escaped JSON or base64 encoded JSON.+- `template` `(string: <optional>)` - The [JSON template](/docs/concepts/oidc-provider#scopes)+string for the scope. This may be provided as escaped JSON or base64 encoded JSON.- `description` `(string: <optional>)` – A description of the scope.@@ -254,18 +255,40 @@ This endpoint creates or updates a client.- `name` `(string: <required>)` – The name of the client. This parameter is specified as part of the URL.- `key` `(string: <required>)` – A reference to a named key resource. This cannot be modified after creation.+- `key` `(string: "default")` – A reference to a [named key](/api-docs/secret/identity/tokens#create-a-named-key)+resource. This key will be used to sign ID tokens for the client. This cannot be modified+after creation. If not supplied, defaults to the built-in [default key](/docs/concepts/oidc-provider#keys).- `redirect_uris` `([]string: <optional>)` - Redirection URI values used by the client. One of these valuesmust exactly match the `redirect_uri` parameter value used in each [authentication request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).- `assignments` `([]string: <optional>)` – A list of assignment resources associated with the client.-- `id_token_ttl` `(int or duration: <optional>)` – The time-to-live for ID tokens obtained by the client.+- `assignments` `([]string: <optional>)` – A list of assignment resources associated with+the client. Client assignments limit the Vault entities and groups that are allowed to+authenticate through the client. By default, no Vault entities are allowed. To allow all+Vault entities to authenticate through the client, supply the built-in+[allow_all](/docs/concepts/oidc-provider#assignments) assignment.+- `client_type` `(string: "confidential")` – The [client type](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1)+based on its ability to maintain confidentiality of credentials. The following list details+the differences between confidential and public clients in Vault:+- `confidential`+- Capable of maintaining the confidentiality of its credentials+- Has a client secret+- Uses the `client_secret_basic` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)+- May use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))+for the authorization code flow+- `public`+- Not capable of maintaining the confidentiality of its credentials+- Does not have a client secret+- Uses the `none` [client authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)+- Must use Proof Key for Code Exchange ([PKCE](https://datatracker.ietf.org/doc/html/rfc7636))+for the authorization code flow+- `id_token_ttl` `(int or duration: "24h")` – The time-to-live for ID tokens obtained by the client.This can be specified as a number of seconds or as a [Go duration format string](https://golang.org/pkg/time/#ParseDuration)like `"30m"` or `"6h"`. The value should be less than the `verification_ttl` on the key.- `access_token_ttl` `(int or duration: <optional>)` – The time-to-live for access tokens obtained by the client.+- `access_token_ttl` `(int or duration: "24h")` – The time-to-live for access tokens obtained by the client.This can be specified as a number of seconds or as a [Go duration format string](https://golang.org/pkg/time/#ParseDuration) like `"30m"` or `"6h"`.### Sample Payload@@ -317,6 +340,7 @@ $ curl \"assignments":[],"client_id":"014zXvcvbvIZWwD5NfD1Uzmv7c5JBRMb","client_secret":"hvo_secret_bZtgQPBZaJXK7F5vOI7JlvEuLOfOUS7DmwynFjE3xKcsen7TyowqPFfYFXG2tbWM",+"client_type": "confidential","id_token_ttl":3600,"key":"test-key","redirect_uris":[]@@ -547,7 +571,8 @@ $ curl \"authorization_code"],"token_endpoint_auth_methods_supported": [-"client_secret_basic"+"client_secret_basic",+"none"]}```@@ -622,6 +647,17 @@ to be used for the [Authorization Code Flow](https://openid.net/specs/openid-con- `nonce` `(string: <optional>)` - A value that is returned in the ID token nonce claim. It is used to mitigate replay attacks, so we *strongly encourage* providing this optional parameter.- `max_age` `(integer: <optional>)` - The allowable elapsed time in seconds since the last+time the end-user was actively authenticated.+- `code_challenge` `(string: <optional>)` - The [PKCE](https://datatracker.ietf.org/doc/html/rfc7636)+code challenge derived from the client's code verifier. Optional for `confidential` clients.+Required for `public` clients.+- `code_challenge_method` `(string: "plain")` - The method that was used to derive the+[PKCE](https://datatracker.ietf.org/doc/html/rfc7636) code challenge. The following+methods are supported: `S256`, `plain`.+### Sample Request```shell-session@@ -659,23 +695,31 @@ for an OIDC provider.### Parameters- `name` `(string: <required>)` - The name of the provider. This parameter is-specified as part of the URL.+specified as part of the URL.- `code` `(string: <required>)` - The authorization code received from the-provider's authorization endpoint.+provider's authorization endpoint.- `grant_type` `(string: <required>)` - The authorization grant type. The-following grant types are supported: `authorization_code`.+following grant types are supported: `authorization_code`.- `redirect_uri` `(string: <required>)` - The callback location where the-authorization request was sent. This must match the `redirect_uri` used when the-original authorization code was generated.+authorization request was sent. This must match the `redirect_uri` used when the+original authorization code was generated.+- `client_id` `(string: <required>)` - The ID of the requesting client. This parameter+is only required for `public` clients which do not have a client secret. `confidential`+clients should not use this parameter.+- `code_verifier` `(string: <optional>)` - The code verifier associated with the given+`code`. Required for authorization codes that were granted using [PKCE](https://datatracker.ietf.org/doc/html/rfc7636).+Required for `public` clients.### Headers- Basic Auth `(string: <required>)` - Authenticate the client using the `client_id`-and `client_secret` as described in the [client_secret_basic authentication method](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication).-The authentication method uses the HTTP Basic authentication scheme.+- `Authorization: Basic` `(string: <required>)` - An HTTP Basic authentication scheme header+including the `client_id` and `client_secret` as described in the [client_secret_basic](https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication)+authentication method. This header is only required for `confidential` clients.### Sample Request
go.sum+2 −2
@@ -886,8 +886,8 @@ github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 h1:p4AKXPPS24tO8Wc8i1gLvSKdmkgithub.com/hashicorp/go-secure-stdlib/mlock v0.1.2/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=github.com/hashicorp/go-secure-stdlib/parseutil v0.1.2/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.3 h1:geBw3SBrxQq+buvbf4K+Qltv1gjaXJxy8asD4CjGYow=-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.3/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.4 h1:hrIH/qrOTHfG9a1Jz6Z2jQf7Xe77AaD464W1fCFLwPQ=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.4/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=github.com/hashicorp/go-secure-stdlib/password v0.1.1 h1:6JzmBqXprakgFEHwBgdchsjaA9x3GyjdI568bXKxa60=github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
builtin/logical/database/backend_test.go+115 −2
@@ -3,7 +3,9 @@ package databaseimport ("context""database/sql"+"fmt""log"+"net/url""os""reflect""strings"@@ -12,6 +14,9 @@ import ("github.com/go-test/deep"mongodbatlas "github.com/hashicorp/vault-plugin-database-mongodbatlas"+"github.com/lib/pq"+"github.com/mitchellh/mapstructure"+"github.com/hashicorp/vault/helper/namespace"postgreshelper "github.com/hashicorp/vault/helper/testhelpers/postgresql"vaulthttp "github.com/hashicorp/vault/http"@@ -25,8 +30,6 @@ import ("github.com/hashicorp/vault/sdk/helper/pluginutil""github.com/hashicorp/vault/sdk/logical""github.com/hashicorp/vault/vault"-"github.com/lib/pq"-"github.com/mitchellh/mapstructure")func getCluster(t *testing.T) (*vault.TestCluster, logical.SystemView) {@@ -1322,6 +1325,116 @@ func TestBackend_RotateRootCredentials(t *testing.T) {}}func TestBackend_ConnectionURL_redacted(t *testing.T) {+cluster, sys := getCluster(t)+t.Cleanup(cluster.Cleanup)+config := logical.TestBackendConfig()+config.StorageView = &logical.InmemStorage{}+config.System = sys+b, err := Factory(context.Background(), config)+if err != nil {+t.Fatal(err)+}+defer b.Cleanup(context.Background())+tests := []struct {+name string+password string+}{+{+name: "basic",+password: "secret",+},+{+name: "encoded",+password: "yourStrong(!)Password",+},+}+respCheck := func(req *logical.Request) *logical.Response {+t.Helper()+resp, err := b.HandleRequest(namespace.RootContext(nil), req)+if err != nil {+t.Fatalf("err: %v", err)+}+if resp == nil {+t.Fatalf("expected a response, resp: %#v", resp)+}+if resp.Error() != nil {+t.Fatalf("unexpected error in response, err: %#v", resp.Error())+}+return resp+}+for _, tt := range tests {+t.Run(tt.name, func(t *testing.T) {+cleanup, u := postgreshelper.PrepareTestContainerWithPassword(t, "13.4-buster", tt.password)+t.Cleanup(cleanup)+p, err := url.Parse(u)+if err != nil {+t.Fatal(err)+}+actualPassword, _ := p.User.Password()+if tt.password != actualPassword {+t.Fatalf("expected computed URL password %#v, actual %#v", tt.password, actualPassword)+}+// Configure a connection+data := map[string]interface{}{+"connection_url": u,+"plugin_name": "postgresql-database-plugin",+"allowed_roles": []string{"plugin-role-test"},+}+req := &logical.Request{+Operation: logical.UpdateOperation,+Path: fmt.Sprintf("config/%s", tt.name),+Storage: config.StorageView,+Data: data,+}+respCheck(req)+// read config+readReq := &logical.Request{+Operation: logical.ReadOperation,+Path: req.Path,+Storage: config.StorageView,+}+resp := respCheck(readReq)+var connDetails map[string]interface{}+if v, ok := resp.Data["connection_details"]; ok {+connDetails = v.(map[string]interface{})+}+if connDetails == nil {+t.Fatalf("response data missing connection_details, resp: %#v", resp)+}+actual := connDetails["connection_url"].(string)+expected := p.Redacted()+if expected != actual {+t.Fatalf("expected redacted URL %q, actual %q", expected, actual)+}+if tt.password != "" {+// extra test to ensure that URL.Redacted() is working as expected.+p, err = url.Parse(actual)+if err != nil {+t.Fatal(err)+}+if pp, _ := p.User.Password(); pp == tt.password {+t.Fatalf("password was not redacted by URL.Redacted()")+}+}+})+}+}+func testCredsExist(t *testing.T, resp *logical.Response, connURL string) bool {t.Helper()var d struct {
go.sum+2 −2
@@ -950,8 +950,8 @@ github.com/hashicorp/raft-boltdb v0.0.0-20171010151810-6e5ba93211ea h1:xykPFhrBAgithub.com/hashicorp/raft-boltdb v0.0.0-20171010151810-6e5ba93211ea/go.mod h1:pNv7Wc3ycL6F5oOWn+tPGo2gWD4a5X+yp/ntwdKLjRk=github.com/hashicorp/raft-boltdb/v2 v2.0.0-20210421194847-a7e34179d62c h1:oiKun9QlrOz5yQxMZJ3tf1kWtFYuKSJzxzEDxDPevj4=github.com/hashicorp/raft-boltdb/v2 v2.0.0-20210421194847-a7e34179d62c/go.mod h1:kiPs9g148eLShc2TYagUAyKDnD+dH9U+CQKsXzlY9xo=-github.com/hashicorp/raft-snapshot v1.0.3 h1:lTgBBGMFcuKBTwHqWZ4r0TLzNsqo/OByCga/kM6F0uM=-github.com/hashicorp/raft-snapshot v1.0.3/go.mod h1:5sL9eUn72lH5DzsFIJ9jaysITbHksSSszImWSOTC8Ic=+github.com/hashicorp/raft-snapshot v1.0.4 h1:EuDuayAJPdiDmVk1ygTDnG2zDzrs0/6/yBuma1IYSow=+github.com/hashicorp/raft-snapshot v1.0.4/go.mod h1:5sL9eUn72lH5DzsFIJ9jaysITbHksSSszImWSOTC8Ic=github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=github.com/hashicorp/serf v0.9.4/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=github.com/hashicorp/serf v0.9.6 h1:uuEX1kLR6aoda1TBttmJQKDLZE1Ob7KN0NPdE7EtCDc=<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>718a4d606012cf848e24fbd429477be03bb41ef7 (#14790)website/content/docs/platform/k8s/injector/annotations.mdx | 6 +++++-1 file changed, 5 insertions(+), 1 deletion(-)
website/content/docs/internals/plugins.mdx+0 −234
@@ -1,236 +0,0 @@-layout: docs-page_title: Plugin System-description: Learn about Vault's plugin system.-# Plugin System-All Vault auth and secret backends are considered plugins. This simple concept-allows both built-in and external plugins to be treated like Legos. Any plugin-can exist at multiple different locations. Different versions of a plugin may-be at each one, with each version differing from Vault's version.-## Built-In Plugins-Built-in plugins are shipped with Vault, often for commonly used implementations,-and require no additional operator intervention to run. Built-in plugins are-just like any other backend code inside Vault.-To use a different or edited version of a built-in plugin, you would first edit-the plugin's code or navigate to the Vault version holding the version of the-plugin you desire. Then, you'd `$ cd` into the `cmd/:plugin-name` directory-contained alongside that plugin's code. For instance, for AppRole, you would:-`$ cd vault/builtin/credential/approle/cmd/approle`. Once in that directory,-you would run `$ go build` to obtain a new binary for the AppRole plugin. Then-you would add it to the plugin catalog as per normal, and enable it.-# Plugin Architecture-Vault's plugins are completely separate, standalone applications that Vault-executes and communicates with over RPC. This means the plugin process does not-share the same memory space as Vault and therefore can only access the-interfaces and arguments given to it. This also means a crash in a plugin can not-crash the entirety of Vault.-It is possible to enable a custom plugin with a name that's identical to a-built-in plugin. In such a situation, Vault will always choose the custom plugin-when enabling it.-## Plugin Lifecycle-Vault plugins are long-running processes that remain running once they are-spawned by Vault, the parent process. Plugin processes can be started by Vault's-active node and performance standby nodes. Additionally, there are cases where-plugin processes may be terminated by Vault. These cases include but are not-limited to:-- Vault active node step-down-- Vault barrier seal-- Vault graceful shutdown-- Disabling a Secrets Engine or Auth method that uses external plugins-- Database configured connection deletion-- Database configured connection update-- Database configured connection reset request-- Database root credentials rotation-- WAL Rollback from a previously failed root credentials rotation operation-The lifecycle of plugin processes are managed automatically by Vault.-Termination of these processes are typical in certain scenarios, such as the-ones listed above. Vault will start plugin processes when needed, typically by-lazily loading the plugin when a request that requires the plugin is received by-Vault. A plugin process may be started or terminated through other internal-processes within Vault as well. Since Vault manages and tracks the lifecycle of-its plugins, these processes should not be terminated by anything other than-Vault.-## Plugin Communication-Vault creates a mutually authenticated TLS connection for communication with the-plugin's RPC server. While invoking the plugin process, Vault passes a [wrapping-token](/docs/concepts/response-wrapping) to the-plugin process' environment. This token is single use and has a short TTL. Once-unwrapped, it provides the plugin with a uniquely generated TLS certificate and-private key for it to use to talk to the original Vault process.-The [`api_addr`][api_addr] must be set in order for the plugin process to-establish communication with the Vault server during mount time. If the storage-backend has HA enabled and supports automatic host address detection-(e.g. Consul), Vault will automatically attempt to determine the `api_addr` as-well.-~> Note: Prior to Vault version 1.9.2, reading the original connection's TLS-connection state is not supported in plugins.-## Plugin Registration-An important consideration of Vault's plugin system is to ensure the plugin-invoked by Vault is authentic and maintains integrity. There are two components-that a Vault operator needs to configure before external plugins can be run, the-plugin directory and the plugin catalog entry.-### Plugin Directory-The plugin directory is a configuration option of Vault, and can be specified in-the [configuration file](/docs/configuration).-This setting specifies a directory in which all plugin binaries must live;-_this value cannot be a symbolic link_. A plugin-can not be added to Vault unless it exists in the plugin directory. There is no-default for this configuration option, and if it is not set plugins can not be-added to Vault.-~> Warning: A Vault operator should take care to lock down the permissions on-this directory to ensure a plugin can not be modified by an unauthorized user-between the time of the SHA check and the time of plugin execution.-### Plugin Catalog-The plugin catalog is Vault's list of approved plugins. The catalog is stored in-Vault's barrier and can only be updated by a Vault user with sudo permissions.-Upon adding a new plugin, the plugin name, SHA256 sum of the executable, and the-command that should be used to run the plugin must be provided. The catalog will-make sure the executable referenced in the command exists in the plugin-directory. When added to the catalog the plugin is not automatically executed,-it instead becomes visible to backends and can be executed by them. For more-information on the plugin catalog please see the [Plugin Catalog API-docs](/api/system/plugins-catalog).-An example of plugin registration in current versions of Vault:-```shell-session-$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \-secret \ # type-myplugin-database-plugin-Success! Registered plugin: myplugin-database-plugin-```-Vault versions prior to v0.10.4 lacked the `vault plugin` operator and the-registration step for them is:-```shell-session-$ vault write sys/plugins/catalog/database/myplugin-database-plugin \-sha256=<SHA256 Hex value of the plugin binary> \-command="myplugin"-Success! Data written to: sys/plugins/catalog/database/myplugin-database-plugin-```-### Plugin Execution-When a backend wants to run a plugin, it first looks up the plugin, by name, in-the catalog. It then checks the executable's SHA256 sum against the one-configured in the plugin catalog. Finally Vault runs the command configured in-the catalog, sending along the JWT formatted response wrapping token and mlock-settings. Like Vault, plugins support [the use of mlock when available](/docs/configuration#disable_mlock).-~> Note: If Vault is configured with `mlock` enabled, then the Vault executable and each-plugin executable in your [plugins directory](/docs/internals/plugins#plugin-directory) must be-given the ability to use the `mlock` syscall.-### Plugin Upgrades-Plugins may be updated by registering and reloading them. More details on the-upgrade procedure can be found in [Upgrading Vault Plugins](/docs/upgrading/plugins).-### Troubleshooting-#### Unrecognized remote plugin message-If the following error is encountered when enabling a plugin secret engine or-auth method:-```sh-Unrecognized remote plugin message:-This usually means that the plugin is either invalid or simply-needs to be recompiled to support the latest protocol.-```-Verify whether the Vault process has `mlock` enabled, and if so run the-following command against the plugin binary:-```sh-sudo setcap cap_ipc_lock=+ep <plugin-binary>-```-# Plugin Development-~> Advanced topic! Plugin development is a highly advanced topic in Vault, and-is not required knowledge for day-to-day usage. If you don't plan on writing any-plugins, we recommend not reading this section of the documentation.-Because Vault communicates to plugins over a RPC interface, you can build and-distribute a plugin for Vault without having to rebuild Vault itself. This makes-it easy for you to build a Vault plugin for your organization's internal use,-for a proprietary API that you don't want to open source, or to prototype-something before contributing it back to the main project.-In theory, because the plugin interface is HTTP, you could even develop a plugin-using a completely different programming language! (Disclaimer, you would also-have to re-implement the plugin API which is not a trivial amount of work.)-Developing a plugin is simple. The only knowledge necessary to write-a plugin is basic command-line skills and basic knowledge of the-[Go programming language](http://golang.org).-Your plugin implementation needs to satisfy the interface for the plugin-type you want to build. You can find these definitions in the docs for the-backend running the plugin.-```go-package main-import (-"os"-myPlugin "your/plugin/import/path"-"github.com/hashicorp/vault/api"-"github.com/hashicorp/vault/sdk/plugin"-)-func main() {-apiClientMeta := &api.PluginAPIClientMeta{}-flags := apiClientMeta.FlagSet()-flags.Parse(os.Args[1:])-tlsConfig := apiClientMeta.GetTLSConfig()-tlsProviderFunc := api.VaultPluginTLSProvider(tlsConfig)-err := plugin.Serve(&plugin.ServeOpts{-BackendFactoryFunc: myPlugin.Factory,-TLSProviderFunc: tlsProviderFunc,-})-if err != nil {-logger := hclog.New(&hclog.LoggerOptions{})-logger.Error("plugin shutting down", "error", err)-os.Exit(1)-}-}-```-And that's basically it! You would just need to change `myPlugin` to your actual-plugin. For more information on how to register and enable your plugin, check out the [Building Plugin Backends](https://learn.hashicorp.com/vault/developer/plugin-backends) tutorial.-[api_addr]: /docs/configuration#api_addr
website/content/docs/plugins/plugin-development.mdx+91 −0
@@ -0,0 +1,91 @@+---+layout: docs+page_title: Plugin Development+description: Learn about Vault plugin development.+---+# Plugin Development+~> Advanced topic! Plugin development is a highly advanced topic in Vault, and+is not required knowledge for day-to-day usage. If you don't plan on writing any+plugins, we recommend not reading this section of the documentation.+Because Vault communicates to plugins over a RPC interface, you can build and+distribute a plugin for Vault without having to rebuild Vault itself. This makes+it easy for you to build a Vault plugin for your organization's internal use,+for a proprietary API that you don't want to open source, or to prototype+something before contributing it back to the main project.+In theory, because the plugin interface is HTTP, you could even develop a plugin+using a completely different programming language! (Disclaimer, you would also+have to re-implement the plugin API which is not a trivial amount of work.)+Developing a plugin is simple. The only knowledge necessary to write+a plugin is basic command-line skills and basic knowledge of the+[Go programming language](http://golang.org).+Your plugin implementation needs to satisfy the interface for the plugin+type you want to build. You can find these definitions in the docs for the+backend running the plugin.+```go+package main+import (+"os"+myPlugin "your/plugin/import/path"+"github.com/hashicorp/vault/api"+"github.com/hashicorp/vault/sdk/plugin"+)+func main() {+apiClientMeta := &api.PluginAPIClientMeta{}+flags := apiClientMeta.FlagSet()+flags.Parse(os.Args[1:])+tlsConfig := apiClientMeta.GetTLSConfig()+tlsProviderFunc := api.VaultPluginTLSProvider(tlsConfig)+err := plugin.Serve(&plugin.ServeOpts{+BackendFactoryFunc: myPlugin.Factory,+TLSProviderFunc: tlsProviderFunc,+})+if err != nil {+logger := hclog.New(&hclog.LoggerOptions{})+logger.Error("plugin shutting down", "error", err)+os.Exit(1)+}+}+```+And that's basically it! You would just need to change `myPlugin` to your actual+plugin.+[api_addr]: /docs/configuration#api_addr+## Building a Plugin from Source+To build a plugin from source, first navigate to the location holding the+desired plugin version. Next, run `go build` to obtain a new binary for the+plugin. Finally,+[register](/docs/plugins/plugin-architecture#plugin-registration) the+plugin and enable it.+## Plugin Development - Resources+For more information on how to register and enable your plugin, refer to the+[Building Plugin Backends](https://learn.hashicorp.com/vault/developer/plugin-backends)+tutorial.+Other HashiCorp plugin development resources:+* [vault-auth-plugin-example](https://github.com/hashicorp/vault-auth-plugin-example)+* [Custom Secrets Engines](https://learn.hashicorp.com/collections/vault/custom-secrets-engine)+### Plugin Development - Resources - Community+See the [Plugin Portal](/docs/plugins/plugin-portal#community) to find+Community plugin examples/guides developed by community members. HashiCorp does+not validate these for correctness.
website/content/docs/secrets/databases/db2.mdx+26 −0
@@ -0,0 +1,26 @@+---+layout: docs+page_title: IBM Db2 - Database - Credentials+description: |-+Manage credentials for IBM Db2 using Vault's OpenLDAP secrets engine.+---+# IBM Db2+Access to Db2 is managed by facilities that reside outside the Db2 database system. By+default, user authentication is completed by a security facility that relies on operating+system based authentication of users and passwords. This means that the lifecycle of user+identities in Db2 aren't capable of being managed using SQL statements and Vault's+database secrets engine.+To provide flexibility in accommodating authentication needs, Db2 ships with authentication+[plugin modules](https://www.ibm.com/docs/en/db2/11.5?topic=ins-ldap-based-authentication-group-lookup-support)+for Lightweight Directory Access Protocol (LDAP). This enables the Db2 database manager to+authenticate users and obtain group membership defined in an LDAP directory, removing the+requirement that users and groups be defined to the operating system.+Vault's [OpenLDAP secrets engine](/docs/secrets/openldap) can be used to manage the lifecycle+of credentials for Db2 environments that have been configured to delegate user authentication+and group membership to an LDAP server. A step-by-step guide on using Vault to manage both+static and dynamic credentials for access to Db2 can be found in the [IBM Db2 Credential Management](https://learn.hashicorp.com/tutorials/vault/ibm-db2-openldap)+learn tutorial.
.release/release-metadata.hcl+6 −0
@@ -0,0 +1,6 @@+url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/vault"+url_docker_registry_ecr = "https://gallery.ecr.aws/hashicorp/vault"+url_license = "https://github.com/hashicorp/vault/blob/main/LICENSE"+url_project_website = "https://www.vaultproject.io/"+url_source_repository = "https://github.com/hashicorp/vault"+url_release_notes = "https://www.vaultproject.io/docs/release-notes".../docs/platform/{aws-mp => aws}/index.mdx | 0.../platform/aws/lambda-extension-cache.mdx | 304 ++++++++++++++++++.../docs/platform/{aws-mp => aws}/run.mdx | 0website/data/docs-nav-data.json | 10 +-4 files changed, 311 insertions(+), 3 deletions(-)rename website/content/docs/platform/{aws-mp => aws}/index.mdx (100%)create mode 100644 website/content/docs/platform/aws/lambda-extension-cache.mdxrename website/content/docs/platform/{aws-mp => aws}/run.mdx (100%)
api/go.sum+2 −1
@@ -113,8 +113,9 @@ github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR3github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=github.com/hashicorp/go-secure-stdlib/mlock v0.1.1 h1:cCRo8gK7oq6A2L6LICkUZ+/a5rLiRXFMf1Qd4xSwxTc=github.com/hashicorp/go-secure-stdlib/mlock v0.1.1/go.mod h1:zq93CJChV6L9QTfGKtfBxKqD7BqqXx5O04A/ns2p5+I=-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1 h1:78ki3QBevHwYrVxnyVeaEz+7WtifHhauYF23es/0KlI=github.com/hashicorp/go-secure-stdlib/parseutil v0.1.1/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.4 h1:hrIH/qrOTHfG9a1Jz6Z2jQf7Xe77AaD464W1fCFLwPQ=+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.4/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=github.com/hashicorp/go-secure-stdlib/password v0.1.1/go.mod h1:9hH302QllNwu1o2TGYtSk8I8kTAN0ca1EHpwhm5Mmzo=github.com/hashicorp/go-secure-stdlib/strutil v0.1.1 h1:nd0HIW15E6FG1MsnArYaHfuw9C2zgzM8LxkG5Ty/788=github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
website/content/docs/partnerships.mdx+1 −1
@@ -16,7 +16,7 @@ This program is intended to be largely a self-service process with links and guiVault is an Identity-based security solution that leverages trusted sources of identity to keep secrets and application data secured with one centralized, audited workflow for tightly controlling access to secrets across applications, systems, and infrastructure while encrypting data both in flight and at rest. For a full description of the current features please refer to the Vault [website](/).Vault has a secure [plugin](/docs/internals/plugins) architecture. Vault’s plugins are completely separate, standalone applications that Vault executes and communicates with over RPC. This means the plugin process does not share the same memory space as Vault and therefore can only access the interfaces and arguments given to it.+Vault has a secure [plugin](/docs/plugins) architecture. Vault’s plugins are completely separate, standalone applications that Vault executes and communicates with over RPC. This means the plugin process does not share the same memory space as Vault and therefore can only access the interfaces and arguments given to it.Vault plugins can be built-in and bundled with the Vault binary, or be external that has to be manually mounted. Built-in plugins are developed by HashiCorp, while external plugins can be developed by HashiCorp, technology partners, or the community. There is a curated collection of all plugins, both built-in and external, located on the [Plugin Portal](/docs/plugin-portal).
website/content/docs/plugins/plugin-architecture.mdx+190 −0
@@ -0,0 +1,190 @@+---+layout: docs+page_title: External Plugin Architecture+description: Learn about Vault's plugin architecture.+---+# External Plugin Architecture+Vault's external plugins are completely separate, standalone applications that Vault+executes and communicates with over RPC. This means the plugin process does not+share the same memory space as Vault and therefore can only access the+interfaces and arguments given to it. This also means a crash in a plugin can not+crash the entirety of Vault.+It is possible to enable a custom plugin with a name that's identical to a+built-in plugin. In such a situation, Vault will always choose the custom plugin+when enabling it.+## External Plugin Lifecycle+Vault external plugins are long-running processes that remain running once they are+spawned by Vault, the parent process. Plugin processes can be started by Vault's+active node and performance standby nodes. Additionally, there are cases where+plugin processes may be terminated by Vault. These cases include, but are not+limited to:+- Vault active node step-down+- Vault barrier seal+- Vault graceful shutdown+- Disabling a Secrets Engine or Auth method that uses external plugins+- Database configured connection deletion+- Database configured connection update+- Database configured connection reset request+- Database root credentials rotation+- WAL Rollback from a previously failed root credentials rotation operation+The lifecycle of plugin processes are managed automatically by Vault.+Termination of these processes are typical in certain scenarios, such as the+ones listed above. Vault will start plugin processes when needed, typically by+lazily loading the plugin when a request that requires the plugin is received by+Vault. A plugin process may be started or terminated through other internal+processes within Vault as well. Since Vault manages and tracks the lifecycle of+its plugins, these processes should not be terminated by anything other than+Vault.+### External Plugin Scaling Characteristics+External plugins are able to leverage [Performance Standbys](/docs/enterprise/performance-standby)+without any explicit action by a plugin author. The default behavior of Vault+Enterprise is to attempt to handle all requests, including requests to plugins,+on performance standbys. If the plugin request makes any attempt to modify+storage, the request will receive a readonly error, and the request routing+code will then forward the request to the active node. In other words, plugins+can scale horizontally on Vault Enterprise without any effort on the plugin+author's part.+## Plugin Communication+Vault creates a mutually authenticated TLS connection for communication with+the plugin's RPC server. Database secrets engines make use of the AutoMTLS+feature of [go-plugin](https://www.github.com/hashicorp/go-plugin) which will+automatically negotiate mTLS for transport authentication. For all other+plugins, Vault passes a [wrapping token](/docs/concepts/response-wrapping) to+the plugin process' environment. This token is single use and has a short TTL.+Once unwrapped, it provides the plugin with a uniquely generated TLS+certificate and private key for it to use to talk to the original Vault+process.+The [`api_addr`](/docs/configuration#api_addr) must be set in order for the+plugin process to establish communication with the Vault server during mount+time. If the storage backend has HA enabled and supports automatic host address+detection (e.g. Consul), Vault will automatically attempt to determine the+`api_addr` as well.+~> Note: Prior to Vault version 1.9.2, reading the original connection's TLS+connection state is not supported in plugins.+## Plugin Registration+An important consideration of Vault's plugin system is to ensure the plugin+invoked by Vault is authentic and maintains integrity. There are two components+that a Vault operator needs to configure before external plugins can be run- the+plugin directory and the plugin catalog entry.+### Plugin Directory+The plugin directory is a configuration option of Vault and can be specified in+the [configuration file](/docs/configuration).+This setting specifies a directory in which all plugin binaries must live;+_this value cannot be a symbolic link_. A plugin+cannot be added to Vault unless it exists in the plugin directory. There is no+default for this configuration option, and if it is not set, plugins cannot be+added to Vault.+~> Warning: A Vault operator should take caution and lock down the permissions on+this directory to ensure a plugin cannot be modified by an unauthorized user+between the time of the SHA check and the time of plugin execution.+### Plugin Catalog+The plugin catalog is Vault's list of approved plugins. The catalog is stored in+Vault's barrier and can only be updated by a Vault user with sudo permissions.+Upon adding a new plugin, the plugin name, SHA256 sum of the executable, and the+command that should be used to run the plugin must be provided. The catalog will+ensure the executable referenced in the command exists in the plugin+directory. When added to the catalog, the plugin is not automatically executed,+but becomes visible to backends and can be executed by them. For more+information on the plugin catalog please see the [Plugin Catalog API+docs](/api-docs/system/plugins-catalog).+An example of plugin registration in current versions of Vault:+```shell-session+$ vault plugin register -sha256=<SHA256 Hex value of the plugin binary> \+secret \ # type+myplugin-database-plugin+Success! Registered plugin: myplugin-database-plugin+```+Vault versions prior to v0.10.4 lacked the `vault plugin` operator and the+registration step for them is:+```shell-session+$ vault write sys/plugins/catalog/database/myplugin-database-plugin \+sha256=<SHA256 Hex value of the plugin binary> \+command="myplugin"+Success! Data written to: sys/plugins/catalog/database/myplugin-database-plugin+```+### Plugin Execution+When a backend wants to run a plugin, it first looks up the plugin, by name, in+the catalog. It then checks the executable's SHA256 sum against the one+configured in the plugin catalog. Finally Vault runs the command configured in+the catalog, sending along the JWT formatted response wrapping token and mlock+settings. Like Vault, plugins support [the use of mlock when available](/docs/configuration#disable_mlock).+~> Note: If Vault is configured with `mlock` enabled, then the Vault executable+and each plugin executable in your [plugins directory](/docs/plugins/plugin-architecture#plugin-directory)+must be given the ability to use the `mlock` syscall.+### Plugin Upgrades+External plugins may be updated by registering and reloading them. More details+on the upgrade procedure can be found in+[Upgrading Vault Plugins](/docs/upgrading/plugins).+## Plugin Multiplexing+Database plugins can be made to implement plugin multiplexing,+allowing a single plugin process to be used for multiple database+connections. This single process, per database plugin, will be multiplexed+across all Vault namespaces for mounts of this type. Multiplexing a plugin+does not affect the current behavior of existing plugins.+To enable multiplexing, the plugin must be compiled with the `ServeMultiplex`+function call from Vault's `dbplugin` package. At this time, there is no+opt-out capability for plugins that implement multiplexing. To use a+non-multiplexed plugin, run an older version of the plugin, i.e., the+plugin calls the `dbplugin.Serve` function. More details+on implementing plugin multiplexing can be found in+[Upgrading Vault Plugins](/docs/secrets/databases/custom#serving-a-plugin-with-multiplexing).+## Troubleshooting+### Unrecognized remote plugin message+If the following error is encountered when enabling a plugin secret engine or+auth method:+<CodeBlockConfig hideClipboard>+```sh+Unrecognized remote plugin message:+This usually means that the plugin is either invalid or simply+needs to be recompiled to support the latest protocol.+```+</CodeBlockConfig>+Verify whether the Vault process has `mlock` enabled, and if so, run the+following command against the plugin binary:+```shell-session+$ sudo setcap cap_ipc_lock=+ep <plugin-binary>+```+
More files changed — see the full commit.
Release delta 1.11.0 → 1.11.3 (contains the fix)
website/content/docs/what-is-vault.mdx+35 −14
@@ -9,17 +9,36 @@ description: >-## What is Vault?Vault is an identity-based **secrets** and encryption management system. A secret is anything that you want to tightly control access to, such as API encryption keys, passwords, or certificates. Vault provides encryption services that are gated by authentication and authorization methods. Using Vault’s UI, CLI, or HTTP API, access to secrets and other sensitive data can be securely stored and managed, tightly controlled (restricted), and auditable.+HashiCorp Vault is an identity-based secrets and encryption management system. A _secret_ is anything that you want to tightly control access to, such as API encryption keys, passwords, and certificates. Vault provides encryption services that are gated by authentication and authorization methods. Using Vault’s UI, CLI, or HTTP API, access to secrets and other sensitive data can be securely stored and managed, tightly controlled (restricted), and auditable.A modern system requires access to a multitude of secrets: database credentials,+A modern system requires access to a multitude of secrets, including database credentials,API keys for external services, credentials for service-oriented architecture-communication, etc. Understanding who is accessing what secrets is already very-difficult and platform-specific. Adding on key rolling, secure storage, and+communication, etc. It can be difficult to understand who is accessing which secrets, especially since this can be platform-specific. Adding on key rolling, secure storage, anddetailed audit logs is almost impossible without a custom solution. This iswhere Vault steps in.Examples work best to showcase Vault. Please see the-[use cases](/docs/use-cases).+Vault validates and authorizes clients (users, machines, apps) before providing them access to secrets or stored sensitive data.++### How does Vault work?+Vault works primarily with tokens and a token is associated to the client's policy. Each policy is path-based and policy rules contrains the actions and accessibility to the paths for each client. With Vault, you can create tokens manually and assign them to your clients, or the clients can log in and obtain a token. The illustration below displays Vault's core workflow.++The core Vault workflow consists of four stages:+* **Authenticate:** Authentication in Vault is the process by which a client supplies information that Vault uses to determine if they are who they say they are. Once the client is authenticated against an auth method, a token is generated and associated to a policy.+* **Validation:** Vault validates the client against third-party trusted sources, such as Github, LDAP, AppRole, and more.+* **Authorize**: A client is matched against the Vault security policy. This policy is a set of rules defining which API endpoints a client has access to with its Vault token. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault.+* **Access**: Vault grants access to secrets, keys, and encryption capabilities by issuing a token based on policies associated with the client’s identity. The client can then use their Vault token for future operations.+### Why Vault?+Most enterprises today have credentials sprawled across their organizations. Passwords, API keys, and credentials are stored in plain text, app source code, config files, and other locations. Because these credentials live everywhere, the sprawl can make it difficult and daunting to really know who has access and authorization to what. Having credentials in plain text also increases the potential for malicious attacks, both by internal and external attackers.+Vault was designed with these challenges in mind. Vault takes all of these credentials and centralizes them so that they are defined in one location, which reduces unwanted exposure to credentials. But Vault takes it a few steps further by making sure users, apps, and systems are authenticated and explicitly authorized to access resources, while also providing an audit trail that captures and preserves a history of clients' actions.The key features of Vault are:@@ -51,16 +70,18 @@ The key features of Vault are:Revocation assists in key rolling as well as locking down systems in thecase of an intrusion.## What is HCP Vault?+-> **Tip**: Learn more about Vault [use cases](/docs/use-cases).+### What is HCP Vault?HCP Vault is a hosted version of Vault, which is operated by HashiCorp to allow organizations to get up and running quickly. HCP Vault uses the same binary as self-hosted Vault, which means you will have a consistent user experience. You can use the same Vault clients to communicate with HCP Vault as you use to communicate with a self-hosted Vault.+HashiCorp Cloud Platform (HCP) Vault is a hosted version of Vault, which is operated by HashiCorp to allow organizations to get up and running quickly. HCP Vault uses the same binary as self-hosted Vault, which means you will have a consistent user experience. You can use the same Vault clients to communicate with HCP Vault as you use to communicate with a self-hosted Vault. Refer to the [HCP Vault](https://cloud.hashicorp.com/docs/vault) documentation to learn more.~> **Note**: Currently, HCP Vault clusters are located on AWS running in multiple regions across North America, Asia, and Europe. We will support additional cloud providers in the future.+> **Hands On:** Try the [Get started](https://learn.hashicorp.com/collections/vault/cloud) tutorial on HashiCorp Learn to set up a managed Vault cluster.To learn more about HCP Vault, see the [HCP Vault documentation](https://cloud.hashicorp.com/docs/vault). You can also get started with HCP Vault by using the HCP portal to set up your managed Vault cluster. Refer to the [Getting Started with HCP Vault](https://learn.hashicorp.com/collections/vault/cloud) tutorial.+### Community## Next Steps+We welcome questions, suggestions, and contributions from the community.See the page on [Vault use cases](/docs/use-cases) to learn about the multiple ways-Vault can be used. Then, continue onwards with the [Getting Started](https://learn.hashicorp.com/collections/vault/getting-started) tutorial to use Vault-to read, write, and create real secrets and see how it works in practice.+* Ask questions in [HashiCorp Discuss](https://discuss.hashicorp.com/c/vault/30).+* Read our [contributing guide](https://github.com/hashicorp/tutorials/blob/main/CONTRIBUTING.md).+* [Submit an issue](https://github.com/hashicorp/vault/issues/new/choose) for bugs and feature requests.
website/content/docs/platform/github-actions.mdx+46 −0
@@ -0,0 +1,46 @@+---+layout: docs+page_title: GitHub Actions+description: >-+GitHub Actions+---+# GitHub Actions+Workflows in GitHub Actions can make use of secrets stored in Vault by using a+[`vault-action`](https://github.com/marketplace/actions/vault-secrets) step.+## Example+Here is an example `vault-action` step in a workflow:+```yaml+jobs:+build:+# ...+steps:+# ...+- name: Import Secrets+uses: hashicorp/vault-action@v2.4.0+with:+url: https://vault.example.com:8200+token: ${{ secrets.VAULT_TOKEN }}+caCertificate: ${{ secrets.VAULT_CA_CERT }}+secrets: |+secret/data/ci/aws accessKey | AWS_ACCESS_KEY_ID ;+secret/data/ci/aws secretKey | AWS_SECRET_ACCESS_KEY ;+secret/data/ci npm_token+```+This example will authenticate to Vault instance at `https://vault.example.com:8200` with the GitHub secrets defined in+`VAULT_TOKEN` and `VAULT_CA_CERT`, and will add environment variables available for next steps in the workflow:+- The secret at path `secret/data/ci/aws` with the key `accessKey` available in the environment variable `AWS_ACCESS_KEY_ID`+- The secret at path `secret/data/ci/aws` with the key `secretKey` available in the environment variable `AWS_SECRET_ACCESS_KEY`+- The secret at path `secret/data/ci` with the key `npm_token` available in the environment variable `NPM_TOKEN`+## Further Information+For more information on using the `vault-action` GitHub Action, visit:+- [`vault-secrets` GitHub action documentation](https://github.com/marketplace/actions/vault-secrets)+- [Vault GitHub actions tutorial](https://learn.hashicorp.com/tutorials/vault/github-actions)
website/content/docs/get-started/developer-qs.mdx+8 −8
@@ -8,6 +8,14 @@ description: Learn how to store and retrieve your first secret.This quick start will explore how to use Vault client libraries inside your application code to store and retrieve your first secret value. Vault takes the security burden away from developers by providing a secure, centralized secret store for an application’s sensitive data: credentials, certificates, encryption keys, and more.The complete code samples for the steps below are available here:+- [Go](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/go/example.go)+- [Ruby](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/ruby/example.rb)+- [C#](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/dotnet/Example.cs)+- [Python](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/python/example.py)+- [Java (Spring)](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/java/Example.java)+For an out-of-the-box runnable demo application showcasing these concepts and more, see the hello-vault repositories ([Go](https://github.com/hashicorp/hello-vault-go), [C#](https://github.com/hashicorp/hello-vault-dotnet) and [Java/Spring Boot](https://github.com/hashicorp/hello-vault-spring)).## Prerequisites@@ -412,14 +420,6 @@ If the secret was fetched successfully, you should see the `Access granted!` mes**That's it! You've just written and retrieved your first Vault secret!**The complete code samples for the steps you've just performed in this quick start are available here:-- [Go](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/go/example.go)-- [Ruby](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/ruby/example.rb)-- [C#](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/dotnet/Example.cs)-- [Python](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/python/example.py)-- [Java (Spring)](https://github.com/hashicorp/vault-examples/blob/main/examples/_quick-start/java/Example.java)-# Additional examplesFor more secure examples of client authentication, see the auth snippets in the [vault-examples](https://github.com/hashicorp/vault-examples) repo.<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>3587d43f722e755e85a37a7f322a664e72e7f7e1 (#16207)website/content/api-docs/secret/pki.mdx | 8 ++++++--1 file changed, 6 insertions(+), 2 deletions(-)
website/content/docs/auth/jwt/oidc-providers/azuread.mdx+127 −0
@@ -0,0 +1,127 @@+---+layout: docs+page_title: OIDC Provider Setup - Auth Methods - Azure Active Directory+description: OIDC provider configuration for Azure Active Directory+---+## Azure Active Directory (AAD)+~> **Note:** Azure Active Directory Applications that have custom signing keys as a result of using+the [claims-mapping](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-claims-mapping)+feature are currently not supported for OIDC authentication.+Reference: [Azure Active Directory v2.0 and the OpenID Connect protocol](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc)+1. Choose your Azure tenant.+1. Go to **Azure Active Directory** and+[register an application](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)+for Vault.+1. Add Redirect URIs with the "Web" type. You may include two redirect URIs,+one for CLI access another one for Vault UI access.+- `http://localhost:8250/oidc/callback`+- `https://hostname:port_number/ui/vault/auth/oidc/oidc/callback`+1. Record the "Application (client) ID" as you will need it as the `oidc_client_id`.+1. Under **Endpoints**, copy the OpenID Connect metadata document URL, omitting the `/well-known...` portion.+- The endpoint URL (`oidc_discovery_url`) will look like: https://login.microsoftonline.com/tenant-guid-dead-beef-aaaa-aaaa/v2.0+1. Under **Certificates & secrets**,+[add a client secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)+Record the secret's value as you will need it as the `oidc_client_secret` for Vault.+### Connect AD group with Vault external group+Reference: [Azure Active Directory with OIDC Auth Method and External Groups](https://learn.hashicorp.com/tutorials/vault/oidc-auth-azure)+To connect the AD group with a [Vault external groups](/docs/secrets/identity#external-vs-internal-groups),+you will need+[Azure AD v2.0 endpoints](https://docs.microsoft.com/en-gb/azure/active-directory/develop/azure-ad-endpoint-comparison).+You should set up a [Vault policy](https://learn.hashicorp.com/tutorials/vault/policies) for the Azure AD group to use.+1. Go to **Azure Active Directory** and choose your Vault application.+1. Go to **Token configuration** and **Add groups claim**. Select "All" or "SecurityGroup" based on+[which groups for a user](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims)+you want returned in the claim.+1. In Vault, enable the OIDC auth method.+1. Configure the OIDC auth method with the `oidc_client_id` (application ID), `oidc_client_secret`+(client secret), and `oidc_discovery_url` (endpoint URL) you recorded from Azure.+```shell+vault write auth/oidc/config \+oidc_client_id="your_client_id" \+oidc_client_secret="your_client_secret" \+default_role="your_default_role" \+oidc_discovery_url="https://login.microsoftonline.com/tenant_id/v2.0"+```+1. Configure the [OIDC Role](/api-docs/auth/jwt#create-role) with the following:+- `user_claim` should be `"sub"` or `"oid"` following the+[recommendation](https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#using-claims-to-reliably-identify-a-user-subject-and-object-id)+from Azure.+- `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.+- `groups_claim` should be set to `"groups"`.+- `oidc_scopes` should be set to `"https://graph.microsoft.com/.default"`.+```shell+vault write auth/oidc/role/your_default_role \+user_claim="sub" \+allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback" \+groups_claim="groups" \+oidc_scopes="https://graph.microsoft.com/.default" \+policies=default+```+1. In Vault, create the [external group](/api-docs/secret/identity/group).+Record the group ID as you will need it for the group alias.+1. From Vault, retrieve the [OIDC accessor ID](/api-docs/system/auth#list-auth-methods)+from the OIDC auth method as you will need it for the group alias's `mount_accessor`.+1. Go to the Azure AD Group you want to attach to Vault's external group. Record the `objectId`+as you will need it as the group alias name in Vault.+1. In Vault, create a [group alias](/api-docs/secret/identity/group-alias)+for the external group and set the `objectId` as the group alias name.+```shell+vault write identity/group-alias \+name="your_ad_group_object_id" \+mount_accessor="vault_oidc_accessor_id" \+canonical_id="vault_external_group_id"+```+### Optional Azure-specific Configuration+If a user is a member of more than 200 groups (directly or indirectly), extra configuration+is required so that Vault can fetch the groups properly.+- In Azure, under the applications **API Permissions**, grant the following permissions:+- Microsoft Graph API permission [Directory.Read.All](https://docs.microsoft.com/en-us/graph/permissions-reference#application-permissions-19)+- In Vault, set `"provider_config"` to Azure.+```shell+vault write auth/oidc/config -<<"EOH"+{+"oidc_client_id": "your_client_id",+"oidc_client_secret": "your_client_secret",+"default_role": "your_default_role",+"oidc_discovery_url": "https://login.microsoftonline.com/tenant_id/v2.0",+"provider_config": {+"provider": "azure"+}+}+EOH+```+- In Vault, add `"profile"` to `oidc_scopes` so the user's id comes back on the JWT.+```shell+vault write auth/oidc/role/your_default_role \+user_claim="email" \+allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback" \+groups_claim="groups" \+oidc_scopes="profile" \+policies="default"+```
go.sum+6 −6
@@ -207,7 +207,6 @@ github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVgithub.com/armon/go-metrics v0.0.0-20190430140413-ec5e00d3c878/go.mod h1:3AMJUQhVx52RsWOnlkpikZr01T/yAVN2gn0861vByNg=github.com/armon/go-metrics v0.3.0/go.mod h1:zXjbSimjXTd7vOpY8B0/2LpvNvDoXBuplAD+gJD3GYs=github.com/armon/go-metrics v0.3.3/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=-github.com/armon/go-metrics v0.3.4/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=github.com/armon/go-metrics v0.3.9/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=github.com/armon/go-metrics v0.3.10 h1:FR+drcQStOe+32sYyJYyZ7FIdgoGGBnwLl+flodp8Uo=github.com/armon/go-metrics v0.3.10/go.mod h1:4O98XIr/9W0sxpJ8UaYkvjk10Iff7SnFrb4QAOwNTFc=@@ -547,7 +546,6 @@ github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDgithub.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=github.com/form3tech-oss/jwt-go v3.2.5+incompatible h1:/l4kBbb4/vGSsdtB5nUe8L7B9mImVMaBPw9L/0TBHU8=github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=-github.com/frankban/quicktest v1.4.0/go.mod h1:36zfPVQyHxymz4cH7wlDmVwDrJuljRB60qkgn7rorfQ=github.com/frankban/quicktest v1.4.1/go.mod h1:36zfPVQyHxymz4cH7wlDmVwDrJuljRB60qkgn7rorfQ=github.com/frankban/quicktest v1.10.0/go.mod h1:ui7WezCLWMWxVWr1GETZY3smRy0G4KWq9vcPtJmFl7Y=github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=@@ -812,8 +810,8 @@ github.com/hashicorp/cap v0.0.0-20220502204956-9a9f4a9d6e61/go.mod h1:zb3VvIFA0lgithub.com/hashicorp/cap v0.1.1/go.mod h1:VfBvK2ULRyqsuqAnjgZl7HJ7/CGMC7ro4H5eXiZuun8=github.com/hashicorp/cap v0.2.1-0.20220502204956-9a9f4a9d6e61 h1:FIf15EEnoIOSXXy58zl89s88iz0jFhWEPMbIGyRoOvo=github.com/hashicorp/cap v0.2.1-0.20220502204956-9a9f4a9d6e61/go.mod h1:zb3VvIFA0lM2lbmO69NjowV9dJzJnZS89TaM9blXPJA=-github.com/hashicorp/consul-template v0.29.0 h1:rDmF3Wjqp5ztCq054MruzEpi9ArcyJ/Rp4eWrDhMldM=-github.com/hashicorp/consul-template v0.29.0/go.mod h1:p1A8Z6Mz7gbXu38SI1c9nt5ItBK7ACWZG4ZE1A5Tr2M=+github.com/hashicorp/consul-template v0.29.1 h1:icm/H7klHYlxpUoWqSmTIWaSLEfGqUJJBsZA/2JhTLU=+github.com/hashicorp/consul-template v0.29.1/go.mod h1:QIohwBuXlKXtsmGGQdWrISlUy4E6LFg5tLZyrw4MyoU=github.com/hashicorp/consul/api v1.4.0/go.mod h1:xc8u05kyMa3Wjr9eEAsIAo3dg8+LywT5E/Cl7cNS5nU=github.com/hashicorp/consul/api v1.12.0 h1:k3y1FYv6nuKyNTqj6w9gXOx5r5CfLj/k/euUeBXj1OY=github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=@@ -1714,8 +1712,9 @@ go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=-go.uber.org/goleak v1.1.11-0.20210813005559-691160354723 h1:sHOAIxRGBp443oHZIPB+HsUGaksVCXVQENPxwTfQdH4=go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=+go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=+go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=@@ -1767,8 +1766,9 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ygolang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=golang.org/x/crypto v0.0.0-20220208050332-20e1d8d225ab/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=golang.org/x/crypto v0.0.0-20220214200702-86341886e292/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=-golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f h1:OeJjE6G4dgCY4PIXvIRQbE8+RX+uXZyGhUy/ksMGJoc=golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d h1:sK3txAijHtOK88l68nt020reeT1ZdKLIYetKl95FzVY=+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
go.sum+2 −2
@@ -998,8 +998,8 @@ github.com/hashicorp/vault-plugin-database-snowflake v0.5.1 h1:/arASm4g8nyZrL2Dxgithub.com/hashicorp/vault-plugin-database-snowflake v0.5.1/go.mod h1:v7EvYChgjpg6Q9NVnoz+5NyUGUfrYsksWtuWeyHX4A8=github.com/hashicorp/vault-plugin-mock v0.16.1 h1:5QQvSUHxDjEEbrd2REOeacqyJnCLPD51IQzy71hx8P0=github.com/hashicorp/vault-plugin-mock v0.16.1/go.mod h1:83G4JKlOwUtxVourn5euQfze3ZWyXcUiLj2wqrKSDIM=-github.com/hashicorp/vault-plugin-secrets-ad v0.13.0 h1:hULVZaireW8XXg7ZWbPp3Qk4nrCPnMfhlE7soiYBzHU=-github.com/hashicorp/vault-plugin-secrets-ad v0.13.0/go.mod h1:WwwDLyCMncZnOOtN2GHw6O4pIWauHhJx2DjRFbGYvV4=+github.com/hashicorp/vault-plugin-secrets-ad v0.13.1 h1:zxIaGsl8FI7B5GKJkXev56HSGowNAeUPy503auFE+Lg=+github.com/hashicorp/vault-plugin-secrets-ad v0.13.1/go.mod h1:5XIn6cw1+gG+WWxK0SdEAKCDOXTp+MX90PzZ7f3Eks0=github.com/hashicorp/vault-plugin-secrets-alicloud v0.12.0 h1:4Ke3dtM7ARa9ga2jI2rW/TouXWZ45hjfwwtcILoErA4=github.com/hashicorp/vault-plugin-secrets-alicloud v0.12.0/go.mod h1:F4KWrlCQZbhP2dFXCkRvbHX2J6CTydlaY0cH+OrLHCE=github.com/hashicorp/vault-plugin-secrets-azure v0.13.0 h1:35JsvhKhvuATkP6vVQisA4prHd2gjzX4AT0CPvPXJ7I=<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>051a3b2654341cc3dcc3c213b23b29454580b70a (#16147)website/content/api-docs/secret/pki.mdx | 5 +++++1 file changed, 5 insertions(+)
go.mod+6 −3
@@ -6,6 +6,8 @@ replace github.com/hashicorp/vault/api => ./apireplace github.com/hashicorp/vault/api/auth/approle => ./api/auth/approlereplace github.com/hashicorp/vault/api/auth/kubernetes => ./api/auth/kubernetes+replace github.com/hashicorp/vault/api/auth/userpass => ./api/auth/userpassreplace github.com/hashicorp/vault/sdk => ./sdk@@ -56,7 +58,7 @@ require (github.com/google/go-metrics-stackdriver v0.2.0github.com/google/tink/go v1.4.0github.com/hashicorp/cap v0.2.1-0.20220502204956-9a9f4a9d6e61-github.com/hashicorp/consul-template v0.29.0+github.com/hashicorp/consul-template v0.29.1github.com/hashicorp/consul/api v1.12.0github.com/hashicorp/errwrap v1.1.0github.com/hashicorp/go-cleanhttp v0.5.2@@ -175,8 +177,8 @@ require (go.opentelemetry.io/otel/sdk v0.20.0go.opentelemetry.io/otel/trace v0.20.0go.uber.org/atomic v1.9.0-go.uber.org/goleak v1.1.11-0.20210813005559-691160354723-golang.org/x/crypto v0.0.0-20220427172511-eb4f295cb31f+go.uber.org/goleak v1.1.12+golang.org/x/crypto v0.0.0-20220622213112-05595931fe9dgolang.org/x/net v0.0.0-20220127200216-cd36cc0744ddgolang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8golang.org/x/sys v0.0.0-20220422013727-9388b58f7150@@ -291,6 +293,7 @@ require (github.com/hashicorp/logutils v1.0.0 // indirectgithub.com/hashicorp/mdns v1.0.4 // indirectgithub.com/hashicorp/serf v0.9.6 // indirect+github.com/hashicorp/vault/api/auth/kubernetes v0.1.0 // indirectgithub.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirectgithub.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87 // indirectgithub.com/huandu/xstrings v1.3.2 // indirect
website/content/docs/auth/jwt/oidc-providers/kubernetes.mdx+228 −0
@@ -0,0 +1,228 @@+---+layout: docs+page_title: OIDC Provider Setup - Auth Methods - Kubernetes+description: OIDC provider configuration for Kubernetes+---+## Kubernetes+Kubernetes can function as an OIDC provider such that Vault can validate its+service account tokens using JWT/OIDC auth.+-> **Note:** The JWT auth engine does **not** use Kubernetes' `TokenReview` API+during authentication, and instead uses public key cryptography to verify the+contents of JWTs. This means tokens that have been revoked by Kubernetes will+still be considered valid by Vault until their expiry time. To mitigate this+risk, use short TTLs for service account tokens or use+[Kubernetes auth](/docs/auth/kubernetes) which _does_ use the `TokenReview` API.+### Using service account issuer discovery+When using service account issuer discovery, you only need to provide the JWT+auth mount with an OIDC discovery URL, and sometimes a TLS certificate authority+to trust. This makes it the most straightforward method to configure if your+Kubernetes cluster meets the requirements.+Kubernetes cluster requirements:+* [`ServiceAccountIssuerDiscovery`][k8s-sa-issuer-discovery] feature enabled.+* Present from 1.18, defaults to enabled from 1.20.+* kube-apiserver's `--service-account-issuer` flag is set to a URL that is+reachable from Vault. Public by default for most managed Kubernetes solutions.+* Must use short-lived service account tokens when logging in.+* Tokens mounted into pods default to short-lived from 1.21.+Configuration steps:+1. Ensure OIDC discovery URLs do not require authentication, as detailed+[here][k8s-sa-issuer-discovery]:+```bash+kubectl create clusterrolebinding oidc-reviewer \+--clusterrole=system:service-account-issuer-discovery \+--group=system:unauthenticated+```+1. Find the issuer URL of the cluster.+```bash+ISSUER="$(kubectl get --raw /.well-known/openid-configuration | jq -r '.issuer')"+```+1. Enable and configure JWT auth in Vault.+1. If Vault is running in Kubernetes:+```bash+kubectl exec vault-0 -- vault auth enable jwt+kubectl exec vault-0 -- vault write auth/jwt/config \+oidc_discovery_url=https://kubernetes.default.svc.cluster.local \+oidc_discovery_ca_pem=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt+```+1. Alternatively, if Vault is _not_ running in Kubernetes:+-> **Note:** When Vault is outside the cluster, the `$ISSUER` endpoint below may+or may not be reachable. If not, you can configure JWT auth using+[`jwt_validation_pubkeys`](#using-jwt-validation-public-keys) instead.+```bash+vault auth enable jwt+vault write auth/jwt/config oidc_discovery_url="${ISSUER}"+```+1. Configure a role and log in as detailed [below](#creating-a-role-and-logging-in).+[k8s-sa-issuer-discovery]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery+### Using JWT validation public keys+This method can be useful if Kubernetes' API is not reachable from Vault or if+you would like a single JWT auth mount to service multiple Kubernetes clusters+by chaining their public signing keys.+Kubernetes cluster requirements:+* [`ServiceAccountIssuerDiscovery`][k8s-sa-issuer-discovery] feature enabled.+* Present from 1.18, defaults to enabled from 1.20.+* This requirement can be avoided if you can access the Kubernetes master+nodes to read the public signing key directly from disk at+`/etc/kubernetes/pki/sa.pub`. In this case, you can skip the steps to+retrieve and then convert the key as it will already be in PEM format.+* Must use short-lived service account tokens when logging in.+* Tokens mounted into pods default to short-lived from 1.21.+Configuration steps:+1. Fetch the service account signing public key from your cluster's JWKS URI.+```bash+# Query the jwks_uri specified in /.well-known/openid-configuration+kubectl get --raw "$(kubectl get --raw /.well-known/openid-configuration | jq -r '.jwks_uri' | sed -r 's/.*\.[^/]+(.*)/\1/')"+```+1. Convert the keys from JWK format to PEM. You can use a CLI tool or an online+converter such as [this one][jwk-to-pem].+1. Configure the JWT auth mount with those public keys.+```bash+vault write auth/jwt/config \+jwt_validation_pubkeys="-----BEGIN PUBLIC KEY-----+MIIBIjANBgkqhkiG9...+-----END PUBLIC KEY-----","-----BEGIN PUBLIC KEY-----+MIIBIjANBgkqhkiG9...+-----END PUBLIC KEY-----"+```+1. Configure a role and log in as detailed [below](#creating-a-role-and-logging-in).+[jwk-to-pem]: https://8gwifi.org/jwkconvertfunctions.jsp+### Creating a role and logging in+Once your JWT auth mount is configured, you're ready to configure a role and+log in. The following assumes you use the projected service account token+available in all pods by default. See [Specifying TTL and audience](#specifying-ttl-and-audience)+below if you'd like to control the audience or TTL.+1. Choose any value from the array of default audiences. In these examples,+there is only one audience in the `aud` array,+`https://kubernetes.default.svc.cluster.local`.+To find the default audiences, either create a fresh token (requires+`kubectl` v1.24.0+):+```shell-session+$ kubectl create token default | cut -f2 -d. | base64 --decode+{"aud":["https://kubernetes.default.svc.cluster.local"], ... "sub":"system:serviceaccount:default:default"}+```+Or read a token from a running pod's filesystem:+```shell-session+$ kubectl exec my-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -f2 -d. | base64 --decode+{"aud":["https://kubernetes.default.svc.cluster.local"], ... "sub":"system:serviceaccount:default:default"}+```+1. Create a role for JWT auth that the `default` service account from the+`default` namespace can use.+```bash+vault write auth/jwt/role/my-role \+role_type="jwt" \+bound_audiences="<AUDIENCE-FROM-PREVIOUS-STEP>" \+user_claim="sub" \+bound_subject="system:serviceaccount:default:default" \+policies="default" \+ttl="1h"+```+1. Pods or other clients with access to a service account JWT can then log in.+```bash+vault write auth/jwt/login \+role=my-role \+jwt=@/var/run/secrets/kubernetes.io/serviceaccount/token+# OR equivalent to:+curl \+--fail \+--request POST \+--header "X-Vault-Request: true" \+--data '{"jwt":"<JWT-TOKEN-HERE>","role":"my-role"}' \+"${VAULT_ADDR}/v1/auth/jwt/login"+```+### Specifying TTL and audience+If you would like to specify a custom TTL or audience for service account tokens,+the following pod spec illustrates a volume mount that overrides the default+admission injected token. This is especially relevant if you are unable to+disable the [--service-account-extend-token-expiration][k8s-extended-tokens]+flag for `kube-apiserver` and want to use short TTLs.+When using the resulting token, you will need to set `bound_audiences=vault`+when creating roles in Vault's JWT auth mount.+```yaml+apiVersion: v1+kind: Pod+metadata:+name: nginx+spec:+# automountServiceAccountToken is redundant in this example because the+# mountPath used overlaps with the default path. The overlap stops the default+# admission injected token from being created. You can use this option to+# ensure only a single token is mounted if you choose a different mount path.+automountServiceAccountToken: false+containers:+- name: nginx+image: nginx+volumeMounts:+- name: custom-token+mountPath: /var/run/secrets/kubernetes.io/serviceaccount+volumes:+- name: custom-token+projected:+defaultMode: 420+sources:+- serviceAccountToken:+path: token+expirationSeconds: 600 # 10 minutes is the minimum TTL+audience: vault # Must match your JWT role's `bound_audiences`+# The remaining sources are included to mimic the rest of the default+# admission injected volume.+- configMap:+name: kube-root-ca.crt+items:+- key: ca.crt+path: ca.crt+- downwardAPI:+items:+- fieldRef:+apiVersion: v1+fieldPath: metadata.namespace+path: namespace+```+[k8s-extended-tokens]: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/#options
website/data/docs-nav-data.json+40 −31
@@ -1348,6 +1348,32 @@"title": "Overview","path": "platform"},+{+"title": "AWS",+"routes": [+{+"title": "Overview",+"path": "platform/aws"+},+{+"title": "Vault Lambda Extension",+"path": "platform/aws/lambda-extension"+},+{+"title": "Running Vault",+"path": "platform/aws/run"+}+]+},+{+"title": "GitHub",+"routes": [+{+"title": "GitHub Actions",+"path": "platform/github-actions"+}+]+},{"title": "Kubernetes","routes": [@@ -1491,65 +1517,48 @@]},{-"title": "AWS",-"routes": [-{-"title": "Overview",-"path": "platform/aws"-},-{-"title": "Vault Lambda Extension",-"path": "platform/aws/lambda-extension"-},-{-"title": "Running Vault",-"path": "platform/aws/run"-}-]-},-{-"title": "ServiceNow",+"title": "Microsoft SQL Server EKM provider","routes": [{"title": "Overview",-"path": "platform/servicenow"+"path": "platform/mssql"},{"title": "Installation",-"path": "platform/servicenow/installation"+"path": "platform/mssql/installation"},{"title": "Configuration",-"path": "platform/servicenow/configuration"+"path": "platform/mssql/configuration"+},+{+"title": "Upgrading",+"path": "platform/mssql/upgrading"},{"title": "Troubleshooting",-"path": "platform/servicenow/troubleshooting"+"path": "platform/mssql/troubleshooting"}]},{-"title": "Microsoft SQL Server EKM provider",+"title": "ServiceNow","routes": [{"title": "Overview",-"path": "platform/mssql"+"path": "platform/servicenow"},{"title": "Installation",-"path": "platform/mssql/installation"+"path": "platform/servicenow/installation"},{"title": "Configuration",-"path": "platform/mssql/configuration"-},-{-"title": "Upgrading",-"path": "platform/mssql/upgrading"+"path": "platform/servicenow/configuration"},{"title": "Troubleshooting",-"path": "platform/mssql/troubleshooting"+"path": "platform/servicenow/troubleshooting"}]}<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>229f5620874311bf714ae43d249198cc29d54b44 (#16166)builtin/logical/pki/path_tidy.go | 7 ++++++-1 file changed, 6 insertions(+), 1 deletion(-)
website/content/docs/plugins/plugin-portal.mdx+2 −1
@@ -134,9 +134,10 @@ Plugin authors who wish to have their plugins listed may file a submission via a- [AWS Cognito](https://github.com/WealthWizardsEngineering/vault-plugin-secrets-cognito)- [Ethereum](https://github.com/immutability-io/vault-ethereum)- [GitHub](https://github.com/martinbaillie/vault-plugin-secrets-github)+- [HydrantID PKI Plugin](https://github.com/PaddyPowerBetfair/vault-plugin-hydrant-pki)- [HSM PKI Plugin](https://github.com/mode51software/vaultplugin-hsmpki)- [OAuth 2.0/OIDC](https://github.com/puppetlabs/vault-plugin-secrets-oauthapp)- [Jenkins](https://github.com/circa10a/vault-plugin-secrets-jenkins)[github-issue]: https://github.com/hashicorp/vault/issues/new?assignees=&labels=ecosystem%2Fplugin&template=plugin-submission.md&title=%5BPlugin+Portal%5D+Plugin+Submission+-+%3CPLUGIN+NAME%3E-[plugin-portal-mdx]: https://github.com/hashicorp/vault/blob/main/website/content/docs/plugin-portal.mdx+[plugin-portal-mdx]: https://github.com/hashicorp/vault/blob/main/website/content/docs/plugins/plugin-portal.mdx<82990506+hc-github-team-secure-vault-core@users.noreply.github.com>c30e2cb2e148462e8b2c1acf350032baf0b8241a (#16225).../docs/platform/k8s/helm/configuration.mdx | 2 +-.../k8s/helm/examples/ha-with-consul.mdx | 13 +++++++++---.../k8s/helm/examples/standalone-tls.mdx | 13 +++++++++---.../content/docs/platform/k8s/helm/run.mdx | 21 ++++++++++++++-----4 files changed, 37 insertions(+), 12 deletions(-)
website/content/docs/auth/jwt/oidc-providers/forgerock.mdx+42 −0
@@ -0,0 +1,42 @@+---+layout: docs+page_title: OIDC Provider Setup - Auth Methods - ForgeRock+description: OIDC provider configuration for ForgeRock+---+## ForgeRock+1. Navigate to Applications -> OAuth 2.0 -> Clients in ForgeRock Access Management.+1. Create new client.+1. Configure Client ID, Client Secret, Scopes and Redirection URIs.+- `client ID`+- `client secret`+- `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.+- `oidc_scopes` should be set to the OIDC scopes.+1. Save Client ID and Client Secret.+### Configuration+1. In Vault, enable the OIDC auth method.+1. Configure the OIDC auth method with the `oidc_client_id` (client ID), `oidc_client_secret`+(client secret), and `oidc_discovery_url` (endpoint URL) from ForgeRock.+```shell+vault write auth/oidc/config \+oidc_client_id="your_client_id" \+oidc_client_secret="your_client_secret" \+default_role="your_default_role" \+oidc_discovery_url="https://openam.example.com:8443/openam/oauth2"+```+1. Configure the [OIDC Role](/api-docs/auth/jwt) with the following:+- `user_claim` should be `"sub"`.+- `allowed_redirect_uris` should be the two redirect URIs for Vault CLI and UI access.+- `oidc_scopes` should be set to the OIDC scopes.+```shell+vault write auth/oidc/role/your_default_role \+user_claim="sub" \+allowed_redirect_uris="http://localhost:8250/oidc/callback,https://online_version_hostname:port_number/ui/vault/auth/oidc/oidc/callback" \+oidc_scopes="your_oidc_scopes" \+policies=default+```
website/content/docs/auth/jwt/oidc-providers/google.mdx+107 −0
@@ -0,0 +1,107 @@+---+layout: docs+page_title: OIDC Provider Setup - Auth Methods - Google+description: OIDC provider configuration for Google+---+Main reference: [Using OAuth 2.0 to Access Google APIs](https://developers.google.com/identity/protocols/OAuth2)+1. Visit the [Google API Console](https://console.developers.google.com).+1. Create or a select a project.+1. Create a new credential via Credentials > Create Credentials > OAuth Client ID.+1. Configure the OAuth Consent Screen. Application Name is required. Save.+1. Select application type: "Web Application".+1. Configure Authorized Redirect URIs.+1. Save client ID and secret.+### Optional Google-specific Configuration+Google-specific configuration is available when using Google as an identity provider from the+Vault JWT/OIDC auth method. The configuration allows Vault to obtain Google Workspace group membership and+user information during the JWT/OIDC authentication flow. The group membership obtained from Google Workspace+may be used for Identity group alias association. The user information obtained from Google Workspace can be+used to copy claims data into resulting auth token and alias metadata via [claim_mappings](/api-docs/auth/jwt#claim_mappings).+#### Setup+To set up the Google-specific handling, you'll need:+- A Google Workspace account with the [super admin role](https://support.google.com/a/answer/2405986?hl=en)+for granting domain-wide delegation API client access.+- The ability to create a service account in [Google Cloud Platform](https://console.developers.google.com/iam-admin/serviceaccounts).+- To enable the [Admin SDK API](https://console.developers.google.com/apis/api/admin.googleapis.com/overview).+- An OAuth 2.0 application with an [external user type](https://support.google.com/cloud/answer/10311615#user-type).+The Google-specific handling that's used to fetch Google Workspace groups and user information in Vault uses+[Google Workspace Domain-Wide Delegation of Authority](https://developers.google.com/admin-sdk/directory/v1/guides/delegation)+for authentication and authorization. You need to follow **all steps** in the [guide](https://developers.google.com/admin-sdk/directory/v1/guides/delegation)+to obtain the key file for a Google service account capable of making requests to the Google Workspace+[User Accounts](https://developers.google.com/admin-sdk/directory/v1/guides/manage-users) and+[Groups](https://developers.google.com/admin-sdk/directory/v1/guides/manage-groups) APIs.+In **step 5** within the section titled+[Delegate domain-wide authority to your service account](https://developers.google.com/admin-sdk/directory/v1/guides/delegation#delegate_domain-wide_authority_to_your_service_account),+the only OAuth scopes that should be granted are:+- `https://www.googleapis.com/auth/admin.directory.group.readonly`+- `https://www.googleapis.com/auth/admin.directory.user.readonly`+~> This is an **important security step** in order to give the service account the least set of privileges+that enable the feature.+The Google service account key file obtained from the steps in the guide must be made available on the+host that Vault is running on.+#### Configuration+- `provider` `(string: <required>)` - Name of the provider. Must be set to "gsuite".+- `gsuite_service_account` `(string: <required>)` - Either the path to or the contents of a Google service+account key file in JSON format. If given as a file path, it must refer to a file that's readable on+the host that Vault is running on. If given directly as JSON contents, the JSON must be properly escaped.+- `gsuite_admin_impersonate` `(string: <required>)` - Email address of a Google Workspace admin to impersonate.+- `fetch_groups` `(bool: false)` - If set to true, groups will be fetched from Google Workspace.+- `fetch_user_info` `(bool: false)` - If set to true, user info will be fetched from Google Workspace using the configured [user_custom_schemas](#user_custom_schemas).+- `groups_recurse_max_depth` `(int: <optional>)` - Group membership recursion max depth. Defaults to 0, which means don't recurse.+- `user_custom_schemas` `(string: <optional>)` - Comma-separated list of Google Workspace [custom schemas](https://developers.google.com/admin-sdk/directory/v1/guides/manage-schemas).+Values set for Google Workspace users using custom schema fields will be fetched and made available as claims that can be used with [claim_mappings](/api-docs/auth/jwt#claim_mappings). Required if [fetch_user_info](#fetch_user_info) is set to true.+Example configuration:+```+vault write auth/oidc/config -<<EOF+{+"oidc_discovery_url": "https://accounts.google.com",+"oidc_client_id": "your_client_id",+"oidc_client_secret": "your_client_secret",+"default_role": "your_default_role",+"provider_config": {+"provider": "gsuite",+"gsuite_service_account": "/path/to/service-account.json",+"gsuite_admin_impersonate": "admin@gsuitedomain.com",+"fetch_groups": true,+"fetch_user_info": true,+"groups_recurse_max_depth": 5,+"user_custom_schemas": "Education,Preferences"+}+}+EOF+```+#### Role+The [user_claim](/api-docs/auth/jwt#user_claim) value of the role must be set to+one of either `sub` or `email` for the Google Workspace group and user information+queries to succeed.+Example role:+```+vault write auth/oidc/role/your_default_role \+allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback,http://localhost:8250/oidc/callback" \+user_claim="sub" \+groups_claim="groups" \+claim_mappings="/Education/graduation_date"="graduation_date" \+claim_mappings="/Preferences/shirt_size"="shirt_size"+```
builtin/logical/ssh/backend_test.go+4 −1
@@ -1480,6 +1480,8 @@ func TestBackend_DefExtTemplatingEnabled(t *testing.T) {"default_extensions_template": true,"default_extensions": map[string]interface{}{"login@foobar.com": "{{identity.entity.aliases." + userpassAccessor + ".name}}",+"login@foobar2.com": "{{identity.entity.aliases." + userpassAccessor + ".name}}, " ++"{{identity.entity.aliases." + userpassAccessor + ".name}}_foobar",},})if err != nil {@@ -1505,7 +1507,8 @@ func TestBackend_DefExtTemplatingEnabled(t *testing.T) {}defaultExtensionPermissions := map[string]string{-"login@foobar.com": testUserName,+"login@foobar.com": testUserName,+"login@foobar2.com": fmt.Sprintf("%s, %s_foobar", testUserName, testUserName),}err = validateSSHCertificate(parsedKey.(*ssh.Certificate), sshKeyID, ssh.UserCert, []string{"tuber"}, map[string]string{}, defaultExtensionPermissions, 16*time.Hour)
go.mod+1 −1
@@ -120,7 +120,7 @@ require (github.com/hashicorp/vault/api v1.7.2github.com/hashicorp/vault/api/auth/approle v0.1.0github.com/hashicorp/vault/api/auth/userpass v0.1.0-github.com/hashicorp/vault/sdk v0.5.2+github.com/hashicorp/vault/sdk v0.5.3-0.20220621155127-c9ca5e0e239bgithub.com/influxdata/influxdb1-client v0.0.0-20200827194710-b269163b24abgithub.com/jackc/pgx/v4 v4.15.0github.com/jcmturner/gokrb5/v8 v8.4.2(#15986) (#16084)api/client.go | 18 +changelog/15986.txt | 2 +command/agent.go | 38 ++-command/agent/config/config.go | 40 ++-command/agent/config/config_test.go | 307 ++++++++++++++++++.../bad-config-disable-idle-connections.hcl | 27 ++.../config-disable-idle-connections-all.hcl | 27 ++...fig-disable-idle-connections-auto-auth.hcl | 27 ++...onfig-disable-idle-connections-caching.hcl | 27 ++.../config-disable-idle-connections-empty.hcl | 27 ++...ig-disable-idle-connections-templating.hcl | 27 ++command/agent/template/template.go | 6 +website/content/docs/agent/index.mdx | 4 +13 files changed, 565 insertions(+), 12 deletions(-)create mode 100644 changelog/15986.txtcreate mode 100644 command/agent/config/test-fixtures/bad-config-disable-idle-connections.hclcreate mode 100644 command/agent/config/test-fixtures/config-disable-idle-connections-all.hclcreate mode 100644 command/agent/config/test-fixtures/config-disable-idle-connections-auto-auth.hclcreate mode 100644 command/agent/config/test-fixtures/config-disable-idle-connections-caching.hclcreate mode 100644 command/agent/config/test-fixtures/config-disable-idle-connections-empty.hclcreate mode 100644 command/agent/config/test-fixtures/config-disable-idle-connections-templating.hcl
Dockerfile+1 −1
@@ -71,7 +71,7 @@ CMD ["server", "-dev"]## UBI DOCKERFILE ##-FROM registry.access.redhat.com/ubi8/ubi-minimal:8.5 as ubi+FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6 as ubiARG BIN_NAME# PRODUCT_VERSION is the version built dist/$TARGETOS/$TARGETARCH/$BIN_NAME,(#16092)changelog/15946.txt | 3 +++sdk/physical/file/file.go | 11 ++++++++---2 files changed, 11 insertions(+), 3 deletions(-)create mode 100644 changelog/15946.txt
More files changed — see the full commit.
References
- ADVISORYhttps://github.com/advisories/GHSA-7cgv-v83v-rr87
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-40186
- WEBhttps://discuss.hashicorp.com
- WEBhttps://discuss.hashicorp.com/t/hcsec-2022-18-vault-entity-alias-metadata-may-leak-between-aliases-with-the-same-name-assigned-to-the-same-entity/44550
- WEBhttps://github.com/hashicorp/vault
- WEBhttps://security.netapp.com/advisory/ntap-20221111-0008